CVE-2026-89959: Linux Kernel VFIO-AP Privilege Escalation

CVE-2026-89959 Overview

CVE-2026-89959 is a Linux kernel vulnerability in the s390 vfio-ap (Adjunct Processor) mediated device driver. The flaw lives in vfio_ap_mdev_cfg_remove, where vfio_ap_config_remove uses bitmap_andnot instead of bitmap_and when clearing bits from the matrix_mdev->matrix.adm bitmap. That bitmap tracks control domains assigned to the mediated device backing a KVM guest. As a result, explicitly unplugged control domains are not removed from the guest, leaving cryptographic control-domain access exposed beyond its intended lifetime on IBM Z systems using AP passthrough.

Critical Impact
A local, authenticated user on an s390 host can retain unauthorized control-domain access to AP cryptographic resources inside a KVM guest after administrators believe those domains were unplugged.

Affected Products

Linux kernel builds for the s390/s390x architecture that include the vfio-ap driver
KVM hypervisor deployments on IBM Z using AP passthrough to guests
Distributions shipping the affected mainline and stable kernels prior to the fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89959 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89959

Vulnerability Analysis

The vfio-ap driver exposes IBM Z Adjunct Processor cryptographic resources to KVM guests through mediated devices. Administrators assign or remove usage and control domains to these mediated devices dynamically. Correct removal semantics depend on bitmap operations that produce the intended subset of remaining domains.

In the vulnerable code path, vfio_ap_config_remove calls bitmap_andnot against matrix_mdev->matrix.adm to strip out control domains that are being unplugged. bitmap_andnot(dst, a, b) computes a AND NOT b, which is not the operation required here. The correct call is bitmap_and, which retains only the intersection between the currently configured control domains and those that should remain assigned. Because the wrong operator is used, targeted control domains are not cleared from the assigned bitmap and therefore continue to be presented to the guest.

Root Cause

The root cause is an incorrect bitmap primitive selection in the control-domain removal routine. Using bitmap_andnot instead of bitmap_and produces the inverse of the intended set membership when reconciling the matrix.adm mask, so hot-unplug requests for control domains silently fail to take effect at the driver level.

Attack Vector

Exploitation requires local access to the s390 KVM host with privileges sufficient to interact with vfio-ap mediated device configuration, or the ability to influence a workflow that unplugs control domains. Because the scope changes across the host/guest boundary, a guest can continue issuing control-domain operations to AP cryptographic hardware that the host operator intended to revoke. This can undermine tenant isolation on multi-tenant IBM Z systems and prolong access to sensitive cryptographic control functions.

No public proof-of-concept exploit is listed in the CVE record. Technical detail is available in the referenced kernel commit 02e72909 and its companion stable backports.

Detection Methods for CVE-2026-89959

Indicators of Compromise

KVM guests continuing to issue AP cryptographic control-domain requests after a host-side unplug event was logged
Divergence between administrator-intended matrix.adm state and the effective control-domain mask reported by vfio-ap sysfs entries
Audit records showing successful control-domain operations from a guest whose mediated device configuration was recently modified

Detection Strategies

Compare the running kernel version against the fixed commits (02e72909, 12871a42, 2ff68bf4, 4bffadde, 6b8a02e2, f7d66afc) across all s390 hosts
Correlate vfio-ap mediated device change events with subsequent AP control-domain usage from the affected guest to detect stale assignments
Inventory s390/s390x hosts running KVM with AP passthrough and flag those on unpatched kernels

Monitoring Recommendations

Ingest kernel and libvirt audit logs into a centralized data lake and alert on vfio-ap reconfiguration events that are not followed by expected control-domain revocation
Monitor /sys/devices/vfio_ap/matrix/*/control_domains for mismatches between intended and observed masks after unplug operations
Track host uptime and kernel build metadata to prioritize s390 systems that have not been rebooted onto patched kernels

How to Mitigate CVE-2026-89959

Immediate Actions Required

Update affected Linux kernels on s390/s390x KVM hosts to a build that includes the fix replacing bitmap_andnot with bitmap_and in vfio_ap_config_remove
Restrict local host access to accounts that require it, and tightly scope permissions on vfio-ap mediated device management interfaces
Audit all currently running KVM guests using AP passthrough to confirm that assigned control domains match the intended configuration

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Reference commits include 02e72909, 12871a42, 2ff68bf4, 4bffadde, 6b8a02e2, and f7d66afc. Consume the patched kernel from your distribution vendor and reboot affected hosts to activate the fix.

Workarounds

Avoid dynamic removal of AP control domains from vfio-ap mediated devices until the host kernel is patched; instead, stop the guest, reconfigure the mediated device, and restart it
Limit AP passthrough to guests whose tenants are already trusted with the full assigned control-domain set, reducing exposure from stale assignments
Enforce least privilege on management tooling that can invoke vfio-ap mediated device changes

bash

# Verify the running s390 kernel and check for the fix commit in distro changelogs
uname -r
rpm -q --changelog kernel | grep -iE 'vfio-ap|vfio_ap_config_remove' | head
# Inspect currently assigned control domains for a vfio-ap mediated device
cat /sys/devices/vfio_ap/matrix/<mdev-uuid>/control_domains