CVE-2026-89956: Linux Kernel vfio-ap Race Condition Vulnerability

CVE-2026-89956 Overview

CVE-2026-89956 is a race condition vulnerability in the Linux kernel's s390/vfio-ap subsystem, which handles virtualization of IBM Z Adjunct Processor (AP) cryptographic devices. The flaw stems from missing lock acquisition when traversing or modifying the matrix_dev->mdev_list list of ap_matrix_mdev objects. Two functions, vfio_ap_mdev_probe and vfio_ap_mdev_for_queue, access the list without holding the required matrix_dev->guests_lock mutex. Concurrent mediated device creation or removal can lead to kernel memory corruption or use-after-free conditions.

Critical Impact
Concurrent access to the mediated device list can trigger kernel memory corruption or use-after-free conditions on IBM Z systems using vfio-ap virtualization.

Affected Products

Linux kernel s390/vfio-ap subsystem on IBM Z architecture
Kernel versions prior to the patched commits 0fd7447, 6479169, and 7fa61c2
Systems running KVM guests with virtualized AP cryptographic adapters

Discovery Timeline

2026-09-16 - CVE-2026-89956 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89956

Vulnerability Analysis

The vulnerability affects the vfio-ap driver, which mediates access to s390 Adjunct Processor cryptographic devices for KVM guests. The kernel maintains a list of ap_matrix_mdev objects in matrix_dev->mdev_list. Proper synchronization requires holding the matrix_dev->guests_lock mutex when traversing or modifying this list.

The vfio_ap_mdev_probe function used the wrong mutex, matrix_dev->mdevs_lock, when adding a newly created ap_matrix_mdev object to the list. This mutex only guards fields inside individual ap_matrix_mdev objects, not the list itself. Concurrent probe and remove operations could corrupt list pointers or free objects still in use by another thread.

The vfio_ap_mdev_for_queue function, called from status_show when reading the status attribute under /sys/bus/ap/devices, iterated the same list without holding any list-protecting lock. A concurrent add or remove during sysfs read could cause the iterator to follow a dangling pointer.

Root Cause

The root cause is incorrect locking discipline [CWE-667]. Developers used mdevs_lock where guests_lock was required to protect list integrity. The fix takes guests_lock before mdevs_lock in status_show to satisfy the documented lock ordering and prevent lockdep splats. The patch also removes redundant NULL assignments to req_trigger and cfg_chg_trigger, which are already zero-initialized by vfio_alloc_device and previously created a window where userspace could observe cleared triggers after device registration.

Attack Vector

Exploitation requires local access to a system running the vulnerable kernel with vfio-ap in use. A local user or workload capable of triggering concurrent mediated device probe, remove, or sysfs status reads can race the operations. Successful races may corrupt kernel memory structures or trigger use-after-free access, potentially leading to denial of service or privilege escalation depending on heap layout.

No verified public exploit code is available for this vulnerability. See the Linux Kernel Commit 0fd7447 for the upstream fix details.

Detection Methods for CVE-2026-89956

Indicators of Compromise

Unexpected kernel oops or panic messages referencing vfio_ap_mdev_probe, vfio_ap_mdev_for_queue, or status_show in the s390/vfio-ap driver.
Lockdep warnings related to matrix_dev->guests_lock or matrix_dev->mdevs_lock ordering in kernel logs.
KASAN reports flagging use-after-free access on ap_matrix_mdev structures.

Detection Strategies

Audit installed kernel package versions on IBM Z hosts and compare against the fixed stable commits 0fd7447, 6479169, and 7fa61c2.
Enable CONFIG_LOCKDEP and CONFIG_KASAN in test environments to surface locking violations and memory safety errors in the vfio-ap driver.
Monitor /var/log/kern.log and dmesg output for crash traces originating from drivers/s390/crypto/vfio_ap_ops.c.

Monitoring Recommendations

Track kernel version inventory across s390x hosts hosting KVM guests with AP passthrough.
Alert on unexpected mdev device creation or removal patterns under /sys/bus/mdev/devices on affected hosts.
Correlate host kernel crashes with guest lifecycle events involving AP-attached virtual machines.

How to Mitigate CVE-2026-89956

Immediate Actions Required

Identify all IBM Z systems running Linux kernels with the s390/vfio-ap module loaded and using AP passthrough to KVM guests.
Apply the upstream stable kernel updates containing commits 0fd7447, 6479169, and 7fa61c2 as soon as vendor packages become available.
Restrict access to mdev creation and removal operations to trusted administrative accounts only.

Patch Information

The fix is available in the Linux stable tree via Linux Kernel Commit 0fd7447, Linux Kernel Commit 6479169, and Linux Kernel Commit 7fa61c2. The patches take matrix_dev->guests_lock before modifying or iterating mdev_list and remove obsolete trigger reset code. Refer to vfio-ap-locking.rst in the kernel documentation tree for the required lock ordering.

Workarounds

Unload the vfio_ap kernel module on hosts that do not require AP passthrough until patches are applied.
Avoid concurrent creation, removal, or status queries of vfio-ap mediated devices on unpatched hosts.
Limit sysfs read access to /sys/bus/ap/devices status attributes to privileged users only.

bash

# Check for vfio_ap module and current kernel version
uname -r
lsmod | grep vfio_ap

# Temporarily unload vfio_ap if not required
sudo modprobe -r vfio_ap

# Prevent automatic load until patched kernel is installed
echo "blacklist vfio_ap" | sudo tee /etc/modprobe.d/blacklist-vfio-ap.conf