CVE-2026-89959

A flaw was found in the Linux kernel's s390/vfio-ap component. An incorrect function was used during the removal of control domains, specifically bitmap_andnot instead of bitmap_and. This error prevents explicitly unplugged control domains from being properly removed from a Kernel-based Virtual Machine (KVM) guest. This could lead to improper resource management and unexpected behavior within virtualized environments.

s390/vfio-ap can fail to remove an explicitly unplugged AP control domain from a KVM guest because vfio_ap_mdev_cfg_remove computes the control domain removal mask with bitmap_andnot instead of the intersection of requested removals and assigned domains. A guest that previously had access to an AP control domain may retain that control domain after the host side configuration attempted to remove it, resulting in an authorization revocation failure. For the CVSS the PR:L is used for the paranoid score because the practical attacker is a local guest or tenant context with prior access to the assigned vfio-ap device, not necessarily a fully privileged host administrator. The issue is not network reachable and requires an s390 KVM deployment using vfio-ap and AP crypto resources. Impact is mainly confidentiality and integrity policy bypass for AP control domain isolation, with limited availability impact in the paranoid interpretation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.