Executive brief
The Linux kernel's s390 VFIO-AP driver did not properly check whether a virtual machine reference was initialized before attempting to access it, potentially causing a system crash. This affects systems using IBM s390 architecture with AP (Accelerator Processor) device virtualization enabled.
Technical details
The vfio_ap device driver implements two AP bus scan callbacks (vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete) that attempt to acquire the matrix_mdev->kvm->lock mutex without first checking if matrix_mdev->kvm is NULL. When a mediated device's KVM reference has not been initialized, dereferencing the NULL pointer causes a kernel null pointer dereference. The fix adds explicit NULL checks before accessing the kvm->lock mutex and reorganizes mutex acquisition to maintain proper lock ordering (kvm->lock before mdevs_lock) to prevent deadlock scenarios. No patch details or mitigation strategies are available from the advisory text.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed