Junglewise Threat Intelligence

CVE-2026-89958: Linux kernel s390/vfio-ap null pointer dereference

CVE-2026-89958 · Severity: info · Published 2026-09-16

Executive brief

The Linux kernel's s390 VFIO-AP driver did not properly check whether a virtual machine reference was initialized before attempting to access it, potentially causing a system crash. This affects systems using IBM s390 architecture with AP (Accelerator Processor) device virtualization enabled.

Technical details

The vfio_ap device driver implements two AP bus scan callbacks (vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete) that attempt to acquire the matrix_mdev->kvm->lock mutex without first checking if matrix_mdev->kvm is NULL. When a mediated device's KVM reference has not been initialized, dereferencing the NULL pointer causes a kernel null pointer dereference. The fix adds explicit NULL checks before accessing the kvm->lock mutex and reorganizes mutex acquisition to maintain proper lock ordering (kvm->lock before mdevs_lock) to prevent deadlock scenarios. No patch details or mitigation strategies are available from the advisory text.

Affected products

  • Linux Linux kernel <UNKNOWN>

Timeline

  • 2026-09-16: disclosed

Related threats