CVE-2026-89956

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

In order to traverse or add/remove ap_matrix_mdev objects in the

matrix_dev->mdev_list, the matrix_dev->guests_lock mutex must be held.

There are two functions that access the list without holding the mutex:

vfio_ap_mdev_probe function

~~~~~~~~~~~~~~~~~~~~~~~~~~~

The vfio_ap_mdev_probe function uses the matrix_dev->mdevs_lock

mutex to guard the add of a newly created ap_matrix_mdev object to the

matrix_dev->mdev_list. This mutex does not protect list access; its purpose

is to guard against concurrent access to fields contained in an

ap_matrix_mdev object. This could lead to kernel memory corruption or

use-after-free if another mdev is created or removed concurrently.

The adding of an ap_matrix_mdev object to matrix_dev->mdev_list

is now guarded by the matrix_dev->guests_lock which is the correct

way to protect against concurrent mdev_l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References