CVE-2026-93238

A flaw was found in the Linux kernel's s390 VFIO-AP (Virtual Function I/O Adjunct Processor) device driver. During certain device hot-plug configuration updates, the driver fails to initialize a memory structure before processing it. A local privileged user could trigger this issue to cause the kernel to evaluate uninitialized stack memory, leading to unintended hardware queue resets for guest virtual machines or a system crash, resulting in a denial of service (DoS).

This vulnerability is rated as having Moderate impact because exploitation requires local privileged access on IBM Z (s390x) architectures and is constrained to causing guest hardware queue disruption or host denial of service, with no compromise of system confidentiality or integrity. The issue specifically affects environments running KVM virtualization where cryptographic Adjunct Processor pass-through mediated devices are actively assigned to virtual guests. Systems running on non-s390x hardware or deployments that do not utilize VFIO-AP device mediation are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.