CVE-2026-89955 Overview
CVE-2026-89955 is a NULL pointer dereference vulnerability in the Linux kernel's s390 vfio-ap (Virtual Function I/O Adjunct Processor) driver. The flaw resides in the status_show() sysfs attribute handler, which can be invoked concurrently while vfio_ap_mdev_probe_queue() is still initializing a queue. During the race window, the queue's driver data has not yet been assigned, causing dev_get_drvdata() to return NULL. That NULL pointer is then passed to vfio_ap_mdev_for_queue(), where q->apqn is dereferenced without validation.
Critical Impact
A local unprivileged user reading the status sysfs attribute during queue probe can trigger a kernel NULL pointer dereference, resulting in a denial of service on affected s390 systems.
Affected Products
- Linux kernel s390 architecture builds with the vfio-ap driver enabled
- IBM Z and LinuxONE systems using Adjunct Processor cryptographic passthrough to KVM guests
- Distributions shipping kernel versions prior to the fixes referenced in the linked stable commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89955 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89955
Vulnerability Analysis
The vulnerability is a race condition [CWE-476] in the s390 vfio-ap mediated device driver. When vfio_ap_mdev_probe_queue() runs, it calls sysfs_create_group() to expose queue attributes, including status, before invoking dev_set_drvdata() to associate the queue structure with the device. Because sysfs attributes become readable immediately upon creation, another process reading status during this narrow window observes a NULL driver data pointer.
The status_show() handler passes this NULL value to vfio_ap_mdev_for_queue(), which unconditionally dereferences q->apqn. The resulting kernel oops crashes the reading task and can destabilize the system, particularly on hosts running cryptographic workloads that rely on AP queue passthrough.
Root Cause
The ordering defect places sysfs attribute creation before driver data assignment. No synchronization primitive protects readers from observing the intermediate state. The fix acquires the update locks before calling sysfs_create_group(); because status_show() acquires guests_lock before reading driver data, any concurrent reader blocks until dev_set_drvdata() completes. As a secondary cleanup, the APQN is read from apdev before allocation and stored in a local variable, then assigned to q->apqn after successful allocation.
Attack Vector
Exploitation requires local access to a Linux s390 host with the vfio-ap driver active and permission to read the queue status sysfs file. An attacker can script repeated reads timed against queue probe events (such as guest lifecycle transitions) to reliably win the race and trigger the NULL dereference. See the kernel stable commit for the exact fix.
Detection Methods for CVE-2026-89955
Indicators of Compromise
- Kernel oops or panic messages referencing status_show, vfio_ap_mdev_for_queue, or vfio_ap_ops in dmesg and /var/log/kern.log
- Unexpected termination of processes reading /sys/devices/vfio_ap/**/status attributes
- Repeated short-interval reads of vfio-ap sysfs status attributes from unprivileged users
Detection Strategies
- Parse kernel ring buffer logs for NULL pointer dereference stack traces originating in the s390 vfio_ap module
- Correlate AP queue probe events with concurrent sysfs read syscalls targeting the queue path
- Enable kernel panic_on_oops in test environments to surface the defect quickly during patch validation
Monitoring Recommendations
- Ship kernel logs to a centralized analytics platform and alert on BUG: or Oops: entries containing vfio_ap
- Monitor auditd for open and read syscalls against /sys/devices/vfio_ap/ from non-root UIDs
- Track kernel version drift across the s390 fleet to confirm patched kernels have been deployed
How to Mitigate CVE-2026-89955
Immediate Actions Required
- Inventory all s390/IBM Z Linux hosts that load the vfio_ap module and identify unpatched kernels
- Apply distribution-provided kernel updates that incorporate the upstream fix commits as soon as they are available
- Restrict local shell access on affected hosts to trusted administrators until patched
Patch Information
The fix has been merged into the Linux stable kernel tree across multiple maintained branches. Reference commits: 31fa0a8a3c33, 69632952aca0, 7db2511fc601, dd6f4ef6f8a3, and e102ce0f4af9. Rebuild or repackage affected kernels to include these changes.
Workarounds
- Tighten permissions on vfio-ap sysfs status attributes so only root can read them, reducing the local attack surface
- Unload the vfio_ap module on hosts that do not require AP cryptographic passthrough to guests
- Avoid concurrent queue probe operations and administrative reads of AP queue attributes during maintenance windows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
