CVE-2026-89956 (GCVE-0-2026-89956)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-21 12:49
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects In order to traverse or add/remove ap_matrix_mdev objects in the matrix_dev->mdev_list, the matrix_dev->guests_lock mutex must be held. There are two functions that access the list without holding the mutex: vfio_ap_mdev_probe function ~~~~~~~~~~~~~~~~~~~~~~~~~~~ The vfio_ap_mdev_probe function uses the matrix_dev->mdevs_lock mutex to guard the add of a newly created ap_matrix_mdev object to the matrix_dev->mdev_list. This mutex does not protect list access; its purpose is to guard against concurrent access to fields contained in an ap_matrix_mdev object. This could lead to kernel memory corruption or use-after-free if another mdev is created or removed concurrently. The adding of an ap_matrix_mdev object to matrix_dev->mdev_list is now guarded by the matrix_dev->guests_lock which is the correct way to protect against concurrent mdev_list access. Also removed the following two lines of code because the matrix_mdev is allocated via vfio_alloc_device macro which uses kzalloc, so req_trigger and cfg_chg_trigger are already zero-initialised when the struct is allocated before the call to vfio_register_emulated_iommu_dev. This prevents a window whereby these triggers are set to NULL after the device is exposed to userspace. matrix_mdev->req_trigger = NULL; matrix_mdev->cfg_chg_trigger = NULL; vfio_ap_mdev_for_queue function ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The status_show function that supports display of the status attribute of the devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue function which iterates the matrix_dev->mdev_list to find the object representing the queue device whose status is to be displayed. In order to traverse this list, the matrix_dev->guests_lock mutex must be held. To fix this, the guests_lock mutex is taken prior to taking the matrix_dev->mdevs_lock mutex in the status_show function. It is taken there rather than the vfio_ap_mdev_for_queue function - where it is needed - because it must be taken prior to the mdevs_lock mutex in order to adhere to the proper locking order and prevent a lockdep splat; also because the mdevs_lock is needed there to access fields within the matrix_mdev object in that function. See the vfio-ap-locking.rst in the linux kernel tree.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2c1ee8983aa377fef4f725162f4f3aa5f9575d4a
Version: 2c1ee8983aa377fef4f725162f4f3aa5f9575d4a
Version: 2c1ee8983aa377fef4f725162f4f3aa5f9575d4a
Version: 2c1ee8983aa377fef4f725162f4f3aa5f9575d4a
Version: 2c1ee8983aa377fef4f725162f4f3aa5f9575d4a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22dc712c170efc1a549e3f872467c880be995ac7",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "530ee1cc71562b6799b9ece187b6c1b757a2c6fa",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "647916988272fe5ecb4bb30cd02b51af9960618a",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "0fd74477d05743d4cd9b25a3b667daa278d53b93",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "7fa61c29850d05e40ca9ed41bfdf57673023f581",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects\n\nIn order to traverse or add/remove ap_matrix_mdev objects in the\nmatrix_dev-\u003emdev_list, the matrix_dev-\u003eguests_lock mutex must be held.\nThere are two functions that access the list without holding the mutex:\n\nvfio_ap_mdev_probe function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe vfio_ap_mdev_probe function uses the matrix_dev-\u003emdevs_lock\nmutex to guard the add of a newly created ap_matrix_mdev object to the\nmatrix_dev-\u003emdev_list. This mutex does not protect list access; its purpose\nis to guard against concurrent access to fields contained in an\nap_matrix_mdev object. This could lead to kernel memory corruption or\nuse-after-free if another mdev is created or removed concurrently.\n\nThe adding of an ap_matrix_mdev object to matrix_dev-\u003emdev_list\nis now guarded by the matrix_dev-\u003eguests_lock which is the correct\nway to protect against concurrent mdev_list access.\n\nAlso removed the following two lines of code because the matrix_mdev is\nallocated via vfio_alloc_device macro which uses kzalloc, so req_trigger\nand cfg_chg_trigger are already zero-initialised when the struct is\nallocated before the call to vfio_register_emulated_iommu_dev. This\nprevents a window whereby these triggers are set to NULL after\nthe device is exposed to userspace.\n\nmatrix_mdev-\u003ereq_trigger = NULL;\nmatrix_mdev-\u003ecfg_chg_trigger = NULL;\n\nvfio_ap_mdev_for_queue function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe status_show function that supports display of the status attribute of\nthe devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue\nfunction which iterates the matrix_dev-\u003emdev_list to find the object\nrepresenting the queue device whose status is to be displayed. In order to\ntraverse this list, the matrix_dev-\u003eguests_lock mutex must be held.\n\nTo fix this, the guests_lock mutex is taken prior to taking the\nmatrix_dev-\u003emdevs_lock mutex in the status_show function. It is taken\nthere rather than the vfio_ap_mdev_for_queue function - where it is\nneeded - because it must be taken prior to the mdevs_lock mutex in order to\nadhere to the proper locking order and prevent a lockdep splat; also\nbecause the mdevs_lock is needed there to access fields within\nthe matrix_mdev object in that function.\n\nSee the vfio-ap-locking.rst in the linux kernel tree."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:49:15.091Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22dc712c170efc1a549e3f872467c880be995ac7"
        },
        {
          "url": "https://git.kernel.org/stable/c/530ee1cc71562b6799b9ece187b6c1b757a2c6fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/647916988272fe5ecb4bb30cd02b51af9960618a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fd74477d05743d4cd9b25a3b667daa278d53b93"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fa61c29850d05e40ca9ed41bfdf57673023f581"
        }
      ],
      "title": "s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89956",
    "datePublished": "2026-09-16T10:32:39.847Z",
    "dateReserved": "2026-09-11T19:38:34.778Z",
    "dateUpdated": "2026-10-21T12:49:15.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.