CVE-2026-89960: Linux Kernel vfio-ap Use-After-Free Vulnerability

CVE-2026-89960 Overview

CVE-2026-89960 is a use-after-free vulnerability in the Linux kernel's s390 vfio-ap (virtual function I/O Adjunct Processor) driver. The flaw resides in vfio_ap_mdev_set_kvm(), where the kvm->arch.crypto.pqap_hook pointer is assigned before update locks are acquired and before the mdev list is checked for a conflicting assignment. When a second mediated device attempts to attach to a KVM instance that already has one, the function returns -EPERM without restoring the hook pointer. A subsequent free of the mediated device leaves guest-executed PQAP instructions dereferencing a stale pointer.

Critical Impact
A local, authenticated user with access to configure vfio-ap mediated devices on an s390 (IBM Z) host can trigger a use-after-free in the host kernel, enabling privilege escalation or host compromise from a guest-adjacent code path.

Affected Products

Linux kernel s390 architecture builds with CONFIG_VFIO_AP enabled
IBM Z (s390x) hosts running KVM with AP crypto passthrough to guests
Distribution kernels prior to the fixes referenced in the mainline and stable trees

Discovery Timeline

2026-09-16 - CVE-2026-89960 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89960

Vulnerability Analysis

The defect is a use-after-free (UAF) in the s390 vfio-ap mediated device driver. vfio_ap_mdev_set_kvm() writes &matrix_mdev->pqap_hook into kvm->arch.crypto.pqap_hook prior to acquiring the update locks that serialize access to the mdev list. If another mdev is already bound to the same KVM, the routine bails out with -EPERM but never rolls back the hook assignment.

Because matrix_mdev->kvm was never set on this failure path, the cleanup function vfio_ap_mdev_unset_kvm() skips clearing the hook when the failing mdev is later closed. When the mdev structure is freed, the hook still references its memory. Any PQAP (Process AP Queue) instruction issued by the guest then traverses pqap_hook_rwsem and dereferences a dangling pointer.

The fix replaces the mdev list iteration with a simple kvm->arch.crypto.pqap_hook != NULL check under proper locking, and reorders lock acquisition to kvm->lock -> pqap_hook_rwsem(write) -> mdevs_lock. This ordering matches the PQAP intercept path, which holds pqap_hook_rwsem in read mode under srcu and vcpu->mutex.

Root Cause

The root cause is a missing rollback on an error path combined with insufficient lock ordering. The hook pointer is published to the KVM structure before the conflict check runs, breaking the invariant that kvm->arch.crypto.pqap_hook points only at the mdev that legitimately owns the KVM. This creates a window where a stale pointer persists after the owning object is freed.

Attack Vector

Exploitation requires local access on an s390 host with permissions to configure vfio-ap mediated devices and attach them to a KVM guest. An attacker races two mdev attachments against the same KVM instance to force the -EPERM path, then triggers freeing of the failing mdev. Any PQAP instruction subsequently executed by a guest running under the affected KVM dereferences freed memory in the host kernel, opening the door to host memory corruption and privilege escalation.

No public proof-of-concept exploit is currently available. See the mainline patch at Linux Kernel Commit 6a180ad for the reference fix.

Detection Methods for CVE-2026-89960

Indicators of Compromise

Unexpected kernel oops, general protection fault, or KASAN use-after-free reports referencing vfio_ap, pqap_hook, or handle_pqap in dmesg or journalctl -k output.
Repeated -EPERM (errno 1) returns from vfio-ap mdev open or set_kvm operations followed by mdev teardown activity.
Guest-triggered host crashes correlated with AP crypto passthrough activity on s390x hosts.

Detection Strategies

Audit kernel versions on all s390x KVM hosts and compare against the fixed commits listed in the vendor references.
Enable CONFIG_KASAN on non-production s390x kernels to surface use-after-free conditions in vfio_ap code paths during testing.
Monitor libvirt and QEMU logs for repeated failed AP matrix mdev attach attempts against the same domain.

Monitoring Recommendations

Forward host dmesg and audit logs to a centralized logging pipeline and alert on kernel oopses containing vfio_ap or pqap.
Track user activity involving /sys/devices/vfio_ap/matrix/ and mdev control interfaces; restrict to a small set of trusted administrators.
Baseline PQAP-related guest exit rates and alert on anomalies that could indicate probing of the race window.

How to Mitigate CVE-2026-89960

Immediate Actions Required

Inventory all s390x hosts running KVM with vfio-ap crypto passthrough and prioritize them for kernel updates.
Apply the vendor-supplied kernel package that incorporates the upstream fix, then reboot to activate the patched kernel.
Restrict shell access and vfio-ap configuration permissions on affected hosts to a minimal set of administrators until patched.

Patch Information

The vulnerability is resolved by upstream commits in the Linux stable tree. Reference commits include Linux Kernel Commit 13bfc94, Linux Kernel Commit 4400270, Linux Kernel Commit 6a180ad, Linux Kernel Commit eb6cc89, and Linux Kernel Commit fc069d0. Consult your Linux distribution's security advisories for backported package versions.

Workarounds

Disable AP crypto passthrough to guests by not assigning vfio-ap mediated devices where the feature is not strictly required.
Unload or blocklist the vfio_ap module on hosts that do not need AP passthrough by adding blacklist vfio_ap to /etc/modprobe.d/.
Constrain access to /dev/vfio/ and the vfio-ap sysfs interfaces using strict group ownership and file permissions.

bash

# Example: prevent the vfio_ap module from loading on hosts that don't need AP passthrough
echo 'blacklist vfio_ap'   | sudo tee /etc/modprobe.d/disable-vfio-ap.conf
echo 'install vfio_ap /bin/true' | sudo tee -a /etc/modprobe.d/disable-vfio-ap.conf
sudo rmmod vfio_ap 2>/dev/null || true

# Verify the running kernel version after patching
uname -r