Executive brief
The Linux kernel's vfio-ap driver manages cryptographic accelerator (AP) devices for virtual machines on IBM s390 systems. When AP adapters or domains are removed from the host system, the guest VM should be notified to revoke access to these unplugged devices. A logic error in the hot-unplug handler causes the notification to be skipped in certain cases, leaving guest VMs with stale access to hardware that is no longer available on the host—a potential privilege escalation or denial-of-service vector.
Technical details
The vfio_ap_mdev_hot_unplug_cfg() function in drivers/s390/crypto/vfio_ap_ops.c incorrectly relies on the return value of bitmap_andnot() to determine whether to trigger a guest APCB (AP Configuration Block) update when AP devices are hot-unplugged. The bug occurs because bitmap_andnot() returns false when the destination bitmap becomes empty after the operation. When the last AP adapter, domain, or control domain is removed, the bits are cleared correctly in the shadow APCB, but bitmap_andnot() returns false, causing the function to skip the guest APCB update. This leaves the KVM guest with stale hardware access to unplugged AP devices. The fix replaces the return value check with bitmap_intersects() to detect if there is any overlap between the shadow APCB and the removal mask, then unconditionally triggers the guest update if an intersection exists. Patches are available in the Linux stable kernel tree (commits 04b35dd88c108b2d2ceaaa396aba1cb4049d5831 and 3a9b049bbdc40165d7f3e20b818eec95e5694d96).
Affected products
- Linux Linux kernel multiple versions via drivers/s390/crypto/vfio_ap_ops.c
Timeline
- 2026-09-16: disclosed: CVE-2026-89957 published on NVD
- 2026-08-12: patched: Patch authored by Anthony Krowiak
- 2026-09-11: other: Patch merged into stable kernel trees by Greg Kroah-Hartman