HIGH Introduced in 6.0
vfio-ap ControlDomain Leak
CVE-2026-89959
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI4.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove The vfio_ap_config_remove function uses the bitmap_andnot function to clear bits from the matrix_mdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmap_and function is used instead.
02KernelScan AI Analysis
Risk summary
On s390 systems using KVM with vfio-ap mediated devices, an incorrect bitmap operation prevents control domains from being properly unplugged from guests when an administrator removes them from the host AP configuration. A guest can retain unauthorized access to cryptographic control domains that should have been revoked, posing a risk in multi-tenant mainframe environments.
Vulnerability analysis
When a host administrator removes a cryptographic control domain from a guest's configuration, a logic error in the driver prevents that domain from being fully detached from the guest. The removal calculation mistakenly preserves the domain assignment instead of clearing it, so the guest continues to have access after it should have been revoked. The correction updates the removal logic so that control domains are properly detached when an administrator removes them. This flaw is specific to mainframe systems using virtualization for cryptographic adapters, and only arises when an administrator changes the host adapter configuration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.0 | 6.1.188 | 12871a4269f1 |
| 6.12 | 6.0 | 6.12.110 | 4bffadde7fc4 |
| 6.18 | 6.0 | 6.18.51 | f7d66afc34bc |
| 7.2 | 6.0 | 7.2.5 | 2ff68bf414de |
| mainline | 6.0 | 7.3-rc1 | 6b8a02e216f6 |
| 6.6 | 6.0 | 6.6.157 | 02e72909453d |
| cip/6.12 | 6.0 | 6.12.111-cip32 | 4bffadde7fc4 |