Executive brief
A Linux kernel synchronization bug in the s390 vfio-ap (AP passthrough for virtualization) driver could allow concurrent access to internal device lists without proper locking. This could lead to memory corruption or a system crash if multiple virtual devices are created or removed at the same time.
Technical details
The vulnerability is a missing mutex lock (concurrency bug) in the s390 vfio-ap driver where the matrix_dev->mdev_list is accessed without holding the required matrix_dev->guests_lock mutex. Two code paths are affected: the vfio_ap_mdev_probe function, which adds new ap_matrix_mdev objects to the list using an incorrect mutex (mdevs_lock instead of guests_lock), and the vfio_ap_mdev_for_queue function called by status_show, which traverses the list without holding guests_lock at all. An attacker with local access to create or remove virtual AP devices concurrently could trigger use-after-free or kernel memory corruption. The fix ensures guests_lock is held during all mdev_list access and corrects the locking order to prevent deadlocks.
Affected products
- Linux Linux kernel Versions prior to fix (exact version not specified in advisory)
Timeline
- 2026-09-16: disclosed