CVE-2026-89958

A flaw was found in the Linux kernel's s390/vfio-ap component. Within the call stack of specific callback functions, a mutex is acquired without properly checking if a critical pointer (matrix_mdev->kvm) is initialized. If this pointer is NULL, attempting to access it will trigger a NULL pointer dereference. This can lead to a system crash, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Low severity for Red Hat because exploitation is constrained to IBM Z (s390x) architectures and requires the use of the VFIO AP mediated device driver for cryptographic adapter passthrough. Systems running on other hardware architectures are unaffected. On vulnerable systems, triggering the condition requires specific AP bus reconfiguration events while mediated devices lack an active guest association, limiting the practical risk in standard deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.