CVE-2026-89958: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89958 Overview

CVE-2026-89958 is a NULL pointer dereference vulnerability in the Linux kernel's s390/vfio-ap driver on IBM Z architecture systems. The flaw resides in the AP (Adjunct Processor) bus scan callback functions vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete. These callbacks attempt to acquire the matrix_mdev->kvm->lock mutex without first verifying that matrix_mdev->kvm is non-NULL. If the kvm pointer was never set, dereferencing it triggers a kernel NULL pointer dereference and results in a kernel oops or panic.

Critical Impact
An unchecked NULL pointer dereference in the vfio-ap device driver can crash the kernel on s390 systems, resulting in denial of service for the host and all guests relying on AP passthrough.

Affected Products

Linux kernel s390 architecture builds with CONFIG_VFIO_AP enabled
IBM Z and LinuxONE systems using vfio-ap mediated device passthrough for cryptographic AP adapters
KVM hosts on s390 exposing AP adapters and domains to guests

Discovery Timeline

2026-09-16 - CVE-2026-89958 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89958

Vulnerability Analysis

The ap_driver structure exposes two callback function pointers used during AP bus scans on s390 systems. The .on_config_changed callback fires at the start of a scan when host AP configuration changes. The .on_scan_complete callback fires after devices are added or removed. The vfio-ap driver implements these via vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete.

Both call paths acquire matrix_mdev->kvm->lock without validating the kvm pointer. When a mediated device exists but has not yet been associated with a KVM guest, matrix_mdev->kvm remains NULL. Attempting to take the mutex on a NULL structure dereferences an invalid address in kernel context.

The patched code adds explicit matrix_mdev->kvm == NULL checks before mutex acquisition. It also relocates the matrix_mdev->kvm->lock acquisition out of vfio_ap_mdev_hot_plug_config into callers, alongside matrix_dev->mdevs_lock, to preserve the required lock ordering.

Root Cause

The root cause is a missing NULL check before pointer dereference [CWE-476]. The vfio-ap driver assumed matrix_mdev->kvm would be valid whenever the callback executed, but the lifecycle of the mediated device permits states in which no KVM instance is bound. Lock ordering requirements (kvm->lock before mdevs_lock) further constrain where the check can safely be placed.

Attack Vector

Exploitation requires a local privileged actor on an s390 host who can create or manipulate vfio-ap mediated devices and trigger AP bus scans, or induce host AP configuration changes. Because the fault occurs in kernel context, a successful trigger causes a kernel oops and denial of service on the host system. No remote network vector is documented, and no evidence of exploitation in the wild has been reported.

The vulnerability manifests when the AP bus scan callbacks execute against a matrix_mdev that has never had its kvm field assigned. See the upstream commits for the exact call-graph and lock ordering fix; no public proof-of-concept is available.

Detection Methods for CVE-2026-89958

Indicators of Compromise

Kernel oops or panic messages referencing vfio_ap_on_cfg_changed, vfio_ap_on_scan_complete, or vfio_ap_mdev_hot_plug_config in dmesg or /var/log/messages.
Unexpected host reboots or KVM guest terminations on s390 systems using AP passthrough shortly after mediated device creation or reconfiguration.
NULL pointer dereference stack traces originating in the drivers/s390/crypto/vfio_ap_ops.c code path.

Detection Strategies

Monitor kernel ring buffer output for oops signatures containing BUG: kernel NULL pointer dereference alongside vfio-ap symbol names.
Correlate AP bus scan events with mdev lifecycle operations to identify pre-binding scan activity.
Track kernel version and patch level across s390 hosts to confirm whether the fix commits are present.

Monitoring Recommendations

Forward kernel logs from s390 KVM hosts into a centralized log platform and alert on vfio_ap fault signatures.
Audit mdevctl and libvirt operations that create or reconfigure vfio-ap mediated devices.
Track host uptime and unexpected crash frequency on s390 systems participating in AP passthrough workloads.

How to Mitigate CVE-2026-89958

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits and reboot affected s390 hosts.
Restrict creation and configuration of vfio-ap mediated devices to trusted administrators only.
Inventory all s390 hosts using vfio-ap passthrough and prioritize patching those exposing AP adapters to untrusted guests.

Patch Information

The fix is available in the mainline and stable Linux kernel trees via the following commits: Kernel Commit 178ea7a1, Kernel Commit 334b435b, Kernel Commit 4f7e869d, Kernel Commit 5e932abf, and Kernel Commit d5034680. Consult your Linux distribution vendor for backported updates matching your deployed kernel branch.

Workarounds

If patching cannot be performed immediately, avoid creating vfio-ap mediated devices that are not immediately bound to a running KVM guest.
Where AP passthrough is not required, unload or blacklist the vfio_ap module to eliminate the vulnerable code path.
Limit access to /sys/devices/vfio_ap/ and related sysfs interfaces to root or dedicated virtualization service accounts.

bash

# Verify vfio_ap module status and disable if not required
lsmod | grep vfio_ap
modprobe -r vfio_ap
echo "blacklist vfio_ap" | sudo tee /etc/modprobe.d/blacklist-vfio-ap.conf