CVE-2026-89960

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()

In vfio_ap_mdev_set_kvm(), kvm->arch.crypto.pqap_hook is set to

&matrix_mdev->pqap_hook before the update locks are acquired and the

mdev list is checked for a conflicting assignment. If another mdev is

already attached to the same KVM instance, the function returns -EPERM

without restoring the hook pointer, leaving kvm->arch.crypto.pqap_hook

pointing at the failing matrix_mdev instead of the mdev that legitimately

owns the KVM.

Since matrix_mdev->kvm is never set on this error path,

vfio_ap_mdev_unset_kvm() will not clean up the hook when matrix_mdev

is later closed. If matrix_mdev is subsequently freed, any PQAP

instruction executed by the guest will dereference the stale pointer

through pqap_hook_rwsem, resulting in a use-after-free.

Since kvm->arch.crypto.pqap_hook is only set in the vfio_ap_mdev_set_kvm()

function and is cleared in th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References