CVE-2026-89955

A flaw was found in the s390/vfio-ap component of the Linux kernel. A local attacker could exploit a race condition during the queue probing process. This occurs when a concurrent read of the 'status' attribute happens before the necessary driver data is initialized, leading to a NULL pointer dereference. Successful exploitation of this vulnerability could result in a system crash, causing a Denial of Service (DoS).

This vulnerability is rated as Low severity because it is strictly limited to the IBM Z (s390x) architecture and requires the use of Adjunct Processor (AP) mediated device virtualization. To trigger the crash, an attacker must possess local access and win a narrow race condition during device queue probing. Workloads operating on other hardware architectures or without AP device pass-through are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.