CVE-2026-89956

A flaw was found in the Linux kernel's s390/vfio-ap component. Two functions, vfio_ap_mdev_probe and vfio_ap_mdev_for_queue, access a list of ap_matrix_mdev objects without holding the required mutex. This concurrency issue could allow an attacker to cause kernel memory corruption or a use-after-free condition, potentially leading to system instability or denial of service.

A race in s390/vfio-ap can occur because matrix_dev mdev_list is modified or traversed without holding the required guests_lock. Concurrent mdev creation removal or status access can corrupt the list state or leave a stale ap_matrix_mdev reference, which makes this a use after free or kernel memory corruption candidate rather than a simple warning. For the CVSS the PR:L is used for the paranoid score because a delegated vfio management user, container root, or service account may be able to exercise mediated device control without full host administration. The issue is local and is not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.