Junglewise Threat Intelligence

CVE-2026-89956: Linux kernel s390 vfio-ap missing lock in matrix device list access

CVE-2026-89956 · Severity: info · Published 2026-09-16

Executive brief

A Linux kernel synchronization bug in the s390 vfio-ap (AP passthrough for virtualization) driver could allow concurrent access to internal device lists without proper locking. This could lead to memory corruption or a system crash if multiple virtual devices are created or removed at the same time.

Technical details

The vulnerability is a missing mutex lock (concurrency bug) in the s390 vfio-ap driver where the matrix_dev->mdev_list is accessed without holding the required matrix_dev->guests_lock mutex. Two code paths are affected: the vfio_ap_mdev_probe function, which adds new ap_matrix_mdev objects to the list using an incorrect mutex (mdevs_lock instead of guests_lock), and the vfio_ap_mdev_for_queue function called by status_show, which traverses the list without holding guests_lock at all. An attacker with local access to create or remove virtual AP devices concurrently could trigger use-after-free or kernel memory corruption. The fix ensures guests_lock is held during all mdev_list access and corrects the locking order to prevent deadlocks.

Affected products

  • Linux Linux kernel Versions prior to fix (exact version not specified in advisory)

Timeline

  • 2026-09-16: disclosed

Related threats