Vulnerability-Lookup

FKIE_CVE-2026-89957

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-09-16 15:18

Severity

8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfio_ap_mdev_hot_unplug_cfg() function uses the return value of bitmap_andnot() to determine whether the guest APCB needs to be updated. However, bitmap_andnot() returns false when the resulting destination bitmap is empty. This means that if the only adapter, domain or control domain assigned to an mdev is removed from the host's AP configuration, the bit is correctly cleared from the shadow APCB, but bitmap_andnot() returns false because the result is an empty bitmap. Consequently, do_hotplug remains 0 and vfio_ap_mdev_update_guest_apcb() is never called, leaving the KVM guest with stale hardware access to the unplugged AP devices. Fix this by replacing the bitmap_andnot() return value check with bitmap_intersects() to determine whether the shadow APCB actually overlaps with the removal mask. If there is an intersection, call bitmap_andnot() solely for its side effect of clearing the bits, then unconditionally set do_hotplug to trigger the guest APCB update.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/04b35dd88c108b2d2ceaaa396aba1cb4049d5831
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3a9b049bbdc40165d7f3e20b818eec95e5694d96
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/753aa3bb1273bc0d36adb013d5915cc8ff6b72a9
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/917f509bfb88048094dbb85c4e9dbc4d6fe4a886
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c45753c32d452d10d8efaeb52587e9e6e8126e33
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f58e824de8577fe411f6199d659731a0f86a7275

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f58e824de8577fe411f6199d659731a0f86a7275",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "3a9b049bbdc40165d7f3e20b818eec95e5694d96",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "753aa3bb1273bc0d36adb013d5915cc8ff6b72a9",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "c45753c32d452d10d8efaeb52587e9e6e8126e33",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "04b35dd88c108b2d2ceaaa396aba1cb4049d5831",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "917f509bfb88048094dbb85c4e9dbc4d6fe4a886",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed\n\nThe vfio_ap_mdev_hot_unplug_cfg() function uses the return value of\nbitmap_andnot() to determine whether the guest APCB needs to be updated.\nHowever, bitmap_andnot() returns false when the resulting destination\nbitmap is empty. This means that if the only adapter, domain or control\ndomain assigned to an mdev is removed from the host\u0027s AP configuration,\nthe bit is correctly cleared from the shadow APCB, but bitmap_andnot()\nreturns false because the result is an empty bitmap. Consequently,\ndo_hotplug remains 0 and vfio_ap_mdev_update_guest_apcb() is never called,\nleaving the KVM guest with stale hardware access to the unplugged AP\ndevices.\n\nFix this by replacing the bitmap_andnot() return value check with\nbitmap_intersects() to determine whether the shadow APCB actually\noverlaps with the removal mask. If there is an intersection, call\nbitmap_andnot() solely for its side effect of clearing the bits, then\nunconditionally set do_hotplug to trigger the guest APCB update."
    }
  ],
  "id": "CVE-2026-89957",
  "lastModified": "2026-09-16T15:18:20.280",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T11:17:06.043",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/04b35dd88c108b2d2ceaaa396aba1cb4049d5831"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3a9b049bbdc40165d7f3e20b818eec95e5694d96"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/753aa3bb1273bc0d36adb013d5915cc8ff6b72a9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/917f509bfb88048094dbb85c4e9dbc4d6fe4a886"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c45753c32d452d10d8efaeb52587e9e6e8126e33"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f58e824de8577fe411f6199d659731a0f86a7275"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-89957 (GCVE-0-2026-89957)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40

Title

s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/f58e824de8577fe41…
https://git.kernel.org/stable/c/3a9b049bbdc40165d…
https://git.kernel.org/stable/c/753aa3bb1273bc0d3…
https://git.kernel.org/stable/c/c45753c32d452d10d…
https://git.kernel.org/stable/c/04b35dd88c108b2d2…
https://git.kernel.org/stable/c/917f509bfb8804809…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 , < f58e824de8577fe411f6199d659731a0f86a7275 (git) Affected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 , < 3a9b049bbdc40165d7f3e20b818eec95e5694d96 (git) Affected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 , < 753aa3bb1273bc0d36adb013d5915cc8ff6b72a9 (git) Affected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 , < c45753c32d452d10d8efaeb52587e9e6e8126e33 (git) Affected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 , < 04b35dd88c108b2d2ceaaa396aba1cb4049d5831 (git) Affected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 , < 917f509bfb88048094dbb85c4e9dbc4d6fe4a886 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f58e824de8577fe411f6199d659731a0f86a7275",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "3a9b049bbdc40165d7f3e20b818eec95e5694d96",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "753aa3bb1273bc0d36adb013d5915cc8ff6b72a9",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "c45753c32d452d10d8efaeb52587e9e6e8126e33",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "04b35dd88c108b2d2ceaaa396aba1cb4049d5831",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            },
            {
              "lessThan": "917f509bfb88048094dbb85c4e9dbc4d6fe4a886",
              "status": "affected",
              "version": "eeb386aeb5b7c8d2dae6a3ba49255d8a97803182",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed\n\nThe vfio_ap_mdev_hot_unplug_cfg() function uses the return value of\nbitmap_andnot() to determine whether the guest APCB needs to be updated.\nHowever, bitmap_andnot() returns false when the resulting destination\nbitmap is empty. This means that if the only adapter, domain or control\ndomain assigned to an mdev is removed from the host\u0027s AP configuration,\nthe bit is correctly cleared from the shadow APCB, but bitmap_andnot()\nreturns false because the result is an empty bitmap. Consequently,\ndo_hotplug remains 0 and vfio_ap_mdev_update_guest_apcb() is never called,\nleaving the KVM guest with stale hardware access to the unplugged AP\ndevices.\n\nFix this by replacing the bitmap_andnot() return value check with\nbitmap_intersects() to determine whether the shadow APCB actually\noverlaps with the removal mask. If there is an intersection, call\nbitmap_andnot() solely for its side effect of clearing the bits, then\nunconditionally set do_hotplug to trigger the guest APCB update."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached when a host AP QCI change is picked up by ap_scan_bus() and vfio_ap_on_cfg_changed() calls vfio_ap_mdev_hot_unplug_cfg(), which fails to push the cleared shadow APCB into a local KVM guest via kvm_arch_crypto_set_masks(); that is a local sysfs/firmware/KVM path with no network, Bluetooth, or USB exposure.\nAC:L - Removing the last adapter, domain, or control domain assigned to a vfio-ap mdev from the host AP configuration empties the shadow APCB so bitmap_andnot() returns false and vfio_ap_mdev_update_guest_apcb() is skipped every time; a single-adapter guest plus sysfs config=0 or HMC unplug is the designed hot-unplug path, with no race or uncontrolled memory layout.\nPR:L - The leftover millicode APCB is exercised by the tenant KVM guest or the unprivileged host kvm-group QEMU process that already holds the vfio-ap mdev, not by host root; kvm_arch_crypto_set_masks() is the revocation the guest then bypasses, and user namespaces cannot create that mdev, so privileges stay Low rather than High.\nUI:N - Once the last assigned adapter or domain is removed from host QCI, the guest CRYCB still contains the old bits and the guest can issue NQAP/DQAP/PQAP immediately; no separate victim mount, click, or other user action is required.\nS:C - The skipped kvm_arch_crypto_set_masks() leaves the guest with millicode-enforced access to AP adapters and domains the host has unplugged, crossing the KVM/vfio-ap passthrough isolation boundary into hardware that may now belong to the host zcrypt stack or another consumer, equivalent to an IOMMU/device isolation bypass.\nC:H - Unauthorized APQNs let the guest dequeue AP replies (DQAP) from queues the host believes were unplugged, disclosing cryptographic request/response data and key material on those adapters and domains.\nI:H - The guest can enqueue arbitrary AP requests (NQAP) and change hardware queue state on adapters and domains that hot-unplug should have revoked, corrupting crypto operations the host believes are no longer available to that guest.\nA:H - With the stale APCB the guest can PQAP(ZAPQ)-reset or flood the unplugged queues, denying host or sibling-guest crypto services (pkey, secure-key LUKS, openCryptoki) that subsequently reuse the same physical adapter or domain."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:37.364Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f58e824de8577fe411f6199d659731a0f86a7275"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a9b049bbdc40165d7f3e20b818eec95e5694d96"
        },
        {
          "url": "https://git.kernel.org/stable/c/753aa3bb1273bc0d36adb013d5915cc8ff6b72a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c45753c32d452d10d8efaeb52587e9e6e8126e33"
        },
        {
          "url": "https://git.kernel.org/stable/c/04b35dd88c108b2d2ceaaa396aba1cb4049d5831"
        },
        {
          "url": "https://git.kernel.org/stable/c/917f509bfb88048094dbb85c4e9dbc4d6fe4a886"
        }
      ],
      "title": "s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89957",
    "datePublished": "2026-09-16T10:32:40.546Z",
    "dateReserved": "2026-09-11T19:38:34.778Z",
    "dateUpdated": "2026-09-16T14:40:37.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-89957

CVE-2026-89957 (GCVE-0-2026-89957)

Tags

Sightings

Nomenclature

Related by attack behaviour