Executive brief
The Linux kernel's s390 architecture contains a use-after-free vulnerability in the VFIO AP (Advanced Performance) device driver's KVM hook management. When a guest machine attempts to share cryptographic hardware across multiple KVM instances, the driver can leave a stale pointer to a freed memory location that will be dereferenced when the guest executes PQAP (QUERY/ASSOCIATE PARAMETER) instructions, causing system crashes or potentially enabling guest code execution on the host.
Technical details
The vulnerability is a use-after-free in vfio_ap_mdev_set_kvm() where kvm->arch.crypto.pqap_hook is assigned before validation, but not restored if a conflicting mdev assignment is detected. When the function returns -EPERM due to another mdev already owning the KVM instance, the hook pointer remains pointing to the newly attempted (and ultimately unused) mdev. Since matrix_mdev->kvm is never set on error, subsequent cleanup via vfio_ap_mdev_unset_kvm() does not clear the stale hook. When the failing mdev is freed and a guest executes a PQAP instruction, the dereferenced pqap_hook pointer accesses freed memory through pqap_hook_rwsem. The fix introduces proper lock ordering (pqap_hook_rwsem acquired within get_update_locks_for_kvm) and ensures kvm_put_kvm() is called after releasing all locks to prevent deadlock. This affects s390 architectures with vfio-ap kernel module loaded.
Affected products
- Linux Linux kernel s390 architecture with vfio-ap module
Timeline
- 2026-09-16: disclosed