CVE-2026-89955

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio-ap: Fix NULL deref in status_show() during queue probe

When vfio_ap_mdev_probe_queue() creates the sysfs attribute group,

the queue's driver data has not yet been set. A concurrent read of

the 'status' attribute can therefore call dev_get_drvdata() and

get NULL, which is then passed directly to

vfio_ap_mdev_for_queue() where q->apqn is unconditionally

dereferenced, causing a NULL pointer dereference.

Fix this by acquiring the update locks before calling

sysfs_create_group(). The status_show() function acquires

guests_lock before reading the driver data, so any concurrent

read will block until after dev_set_drvdata() has been called

and the update locks are released.

As a bonus, the APQN no longer needs to be read from the queue

struct after allocation — it can be read directly from apdev

before allocation and stored in a local variable, which is then

assigned to q->apqn once the allocation succeeds.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References