Look up another CVE · open CVE-2026-89959 in the interactive tracker
CVE-2026-89959
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/s390. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-89959 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The vfio_ap_config_remove function uses the bitmap_andnot function to clear bits from the matrix_mdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmap_and function is used instead.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/s390/crypto/vfio_ap_ops.c
- What this is
- S390 VFIO AP DRIVERMAINTAINERS section matched on drivers/s390/crypto/vfio_ap* · linux-s390@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_S390|CONFIG_VFIO_AP' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_S390, CONFIG_VFIO_AP
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/s390
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.0 | 6.1.188 | 12871a4269f1 |
| 6.0 | 6.6.157 | 02e72909453d |
| 6.0 | 6.12.110 | 4bffadde7fc4 |
| 6.0 | 6.18.51 | f7d66afc34bc |
| 6.0 | 7.2.5 | 2ff68bf414de |
| 6.0 | 7.3 | 6b8a02e216f6 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached when the host AP bus scan (ap_scan_bus → vfio_ap_on_cfg_changed → vfio_ap_mdev_cfg_remove) fails to clear control-domain bits from a KVM guest CRYCB; that is a local s390 vfio-ap/KVM path with no network, Bluetooth, or USB exposure.
- AC:LAttack complexity, low
- bitmap_andnot(cdrem, cd_remove, matrix.adm) always yields removed domains that are not assigned to the mdev, so assigned control domains are never unplugged. After QCI drops a domain assigned to the mdev, leftover guest ADM bits persist deterministically with no race or uncontrolled memory layout.
- PR:LPrivileges required, low
- Leftover ADM bits are consumed by the tenant KVM guest (or an unprivileged kvm-group QEMU process holding a delegated vfio-ap mdev) via millicode-enforced AP instructions with no host capability check. Creating the mdev is admin setup; exploiting the failed unplug does not require init-namespace root.
- UI:NUser interaction, none
- After the host AP configuration change, vfio_ap_mdev_cfg_remove runs from the AP bus workqueue with no further victim action, and the guest itself issues NQAP/PQAP against the stale control domains. No mount, click, or other user interaction is required.
- S:CScope, changed
- Leftover ADM bits in the guest CRYCB grant millicode-enforced rights to modify AP control domains the host intended to revoke, crossing the vfio-ap/KVM passthrough isolation boundary into the host or another consumer's crypto-domain authority, including nested guests whose shadow APCB is ANDed with the stale L1 mask.
- C:HConfidentiality impact, high
- Control domains authorize AP commands that operate on other domains' key material (for example setting a secure private key). Stale ADM bits let the guest keep targeting those domains through remaining usage-domain queues, disclosing or wrapping keys that should belong to host zcrypt or another guest.
- I:HIntegrity impact, high
- With leftover control-domain access the guest can still submit AP command-request messages that change master keys and other domain state for domains removed from the host AP configuration, corrupting crypto state the host believes was unplugged and is no longer delegated to that VM.
- A:HAvailability impact, high
- The guest can keep changing or destroying keys on the unplugged control domains and issue AP commands that render those domains unusable for the host or a sibling guest that should have received them after the QCI removal, denying IBM Z crypto services that depend on those domains.