Executive brief
A race condition in the Linux kernel's s390 vfio-ap (virtual function I/O Advanced Performance) driver can cause a system crash when an accelerator queue is being probed. If a user reads the queue's status attribute at precisely the wrong moment during initialization, the kernel will crash due to a null pointer dereference. This affects systems using s390 cryptographic accelerator hardware, potentially causing denial of service during device initialization.
Technical details
This is a NULL pointer dereference vulnerability (CWE-476) in the vfio-ap driver's queue probe path. The root cause is a race condition: when vfio_ap_mdev_probe_queue() creates the sysfs attribute group, the queue's driver data (drvdata) has not yet been set. A concurrent read of the 'status' sysfs attribute can call dev_get_drvdata() and receive NULL, which is then unconditionally dereferenced in vfio_ap_mdev_for_queue(). The fix acquires update locks before calling sysfs_create_group() and adds a NULL check in status_show(). The attack vector requires local access and ability to read sysfs files (no special privileges needed for reads). The window is extremely narrow but exploitable through timing attacks or rapid sysfs polling during queue probe. Patches are available in the Linux stable tree.
Affected products
- Linux Linux kernel s390/vfio-ap driver (affected in multiple kernel versions prior to fix commit dd6f4ef6f8a37412909ad787c837332fb070159c)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-08-12: patched: Fix commit dd6f4ef6f8a37412909ad787c837332fb070159c authored by Anthony Krowiak
- 2026-09-14: other: Fix merged to stable tree by Greg Kroah-Hartman