CVE-2026-53116: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53116 Overview

CVE-2026-53116 is a use-after-free (UAF) vulnerability in the Linux kernel's s390/ap (Adjunct Processor) bus driver. The flaw stems from unsynchronized access to the driver_override field when AP masks are updated through apmask_store() or aqmask_store(). After ap_attr_mutex is released, ap_bus_revise_bindings() invokes __ap_revise_reserved(), which reads driver_override without holding any lock. A concurrent driver_override_store() can free the old string while it is being accessed, leading to a use-after-free condition on s390 architecture systems.

Critical Impact
A race condition between AP mask updates and driver_override modifications can trigger a use-after-free in kernel memory on s390 systems running the affected kernel versions.

Affected Products

Linux Kernel - s390/ap bus subsystem (Adjunct Processor on IBM Z mainframes)
Linux distributions shipping affected kernel revisions prior to the upstream fix
s390 cryptographic adapter workloads relying on AP queue device binding

Discovery Timeline

2026-06-24 - CVE CVE-2026-53116 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53116

Vulnerability Analysis

The Linux kernel's s390/ap bus driver implements a custom driver_override mechanism for binding AP cryptographic devices to specific drivers. Unlike most kernel buses that rely on the generic driver-core driver_override infrastructure, the AP bus historically maintained its own implementation with bespoke locking semantics.

When userspace writes to apmask or aqmask sysfs attributes, the kernel invokes ap_bus_revise_bindings() after releasing ap_attr_mutex. This function calls __ap_revise_reserved(), which dereferences the per-device driver_override string pointer. Because no lock protects this read, a concurrent writer executing driver_override_store() can free the previously allocated string, leaving the reader with a dangling pointer.

The AP bus also differs from typical buses by checking driver_override in ap_device_probe() and __ap_revise_reserved() rather than in the bus match() callback. Maintaining custom synchronization across these code paths was the underlying source of the race.

Root Cause

The root cause is missing lock coverage on the driver_override field. The custom AP implementation released ap_attr_mutex before traversing devices and reading driver_override, creating a window where driver_override_store() could kfree() the string concurrently. This is a classic [CWE-416] Use-After-Free condition arising from a [CWE-362] race condition.

Attack Vector

Exploitation requires local access to a Linux system with the s390/ap bus exposed and sufficient privileges to write to the sysfs attributes apmask, aqmask, and driver_override. An attacker capable of issuing concurrent writes to these attributes can trigger the freed-pointer dereference. The fix migrates the AP bus to the generic driver-core driver_override infrastructure, which serializes all accesses with an internal spinlock. See the Kernel Git Commit Fix for the upstream patch.

Detection Methods for CVE-2026-53116

Indicators of Compromise

Kernel oops, BUG:, or KASAN "use-after-free" reports referencing __ap_revise_reserved, ap_bus_revise_bindings, or driver_override_store in the call stack
Unexpected kernel panics on s390 systems during concurrent sysfs writes to /sys/bus/ap/devices/*/driver_override
Audit log entries showing repeated writes to apmask, aqmask, and driver_override from non-administrative processes

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to surface the use-after-free during fuzzing of AP sysfs attributes
Correlate dmesg crash signatures containing AP bus symbols with the process responsible for the sysfs write via audit subsystem records
Inventory s390 hosts and verify their installed kernel version against the upstream fix commit 8f2eca0570438b94602da1297353eb7b10dcb6cb

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on AP bus crash signatures
Monitor auditd rules covering writes to /sys/bus/ap/ attributes from unexpected UIDs
Track kernel package versions across IBM Z fleet inventories to ensure patch coverage

How to Mitigate CVE-2026-53116

Immediate Actions Required

Apply the upstream kernel patch that migrates the s390/ap bus to the generic driver-core driver_override infrastructure
Restrict write access to /sys/bus/ap/devices/*/driver_override, apmask, and aqmask to trusted administrative accounts only
Audit any automation that writes to AP sysfs attributes to ensure it does not race with mask updates

Patch Information

The vulnerability is resolved upstream by replacing the custom driver_override handling with the generic driver-core infrastructure. Reference commits: Kernel Git Commit Fix and Kernel Git Commit Update. Distribution maintainers should backport both commits to supported kernel branches. Note that the patch does not enable the driver_override feature of struct bus_type because the AP bus emits "" rather than "(null)\n" through sysfs_emit() when the override pointer is NULL.

Workarounds

Limit access to AP sysfs attributes using strict file permissions and SELinux or AppArmor policies until the patched kernel is deployed
Avoid running concurrent management tooling that simultaneously writes apmask/aqmask and driver_override on the same host
Where feasible, restrict s390 cryptographic adapter administration to a single privileged orchestrator process to eliminate concurrency

bash

# Verify installed kernel against the upstream fix
uname -r
# Inspect AP sysfs attribute permissions on s390 hosts
ls -l /sys/bus/ap/apmask /sys/bus/ap/aqmask
find /sys/bus/ap/devices -name driver_override -exec ls -l {} \;
# Tighten permissions where exposed beyond root
chmod 600 /sys/bus/ap/apmask /sys/bus/ap/aqmask