Executive brief
The Linux kernel's s390 VFIO AP driver incorrectly handles the removal of cryptographic control domains from virtual machines. When unplugging control domains from a guest, the driver uses the wrong bitmap operation, preventing proper cleanup and potentially allowing unauthorized access to cryptographic resources or causing denial of service through resource exhaustion.
Technical details
The vulnerability is a logic error in the vfio_ap_mdev_cfg_remove function within drivers/s390/crypto/vfio_ap_ops.c. The code incorrectly calls bitmap_andnot() instead of bitmap_and() when clearing control domain bits from the matrix_mdev->matrix.adm bitmap. This causes explicitly unplugged control domains to remain assigned to the KVM guest, leading to improper device access control. The bug affects the s390 architecture's VFIO AP (virtualized cryptographic adapter) module, which manages access to cryptographic hardware for virtual machines. The fix changes a single bitmap operation call from bitmap_andnot to bitmap_and. Patches have been integrated into the stable Linux kernel trees.
Affected products
- Linux Linux Kernel multiple versions (s390 architecture)
Timeline
- 2026-09-16: disclosed: CVE-2026-89959 published
- 2026-09-14: patched: Fix committed to stable kernel branches