CVE-2026-89959 s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the matrixmdev-matrix.adm bitmap specifies the control domains assigned to the mdev...

EUVD-2026-80559

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the matrixmdev-matrix.adm bitmap specifies the control domains assigned to the mdev...

CVE-2026-89957 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

CVE-2026-89957

CVE-2026-89957 affects the Linux kernel s390 vfio-ap driver. In vfio_ap_mdev_hot_unplug_cfg(), the return value of bitmap_andnot() is used to decide whether the guest APCB needs updating. When the last AP adapter or domain assigned to an mdev is removed, the resulting empty bitmap causes bitmap_a...

CVE-2026-89955

A NULL pointer dereference vulnerability exists in the Linux kernel's s390/vfio-ap module. The race occurs when vfio_ap_mdev_probe_queue() creates the sysfs attribute group before the queue's driver data is set; a concurrent read of the status attribute then retrieves NULL via dev_get_drvdata() a...

EUVD-2026-80555

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89956

CVE-2026-89956 affects the s390/vfio-ap subsystem of the Linux kernel. The root cause is a missing matrix_dev->guests_lock mutex when traversing or modifying the mdev_list of ap_matrix_mdev objects. Two functions are affected: vfio_ap_mdev_probe , which added objects to the list using the wron...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89926 KVM: s390: Fix length check __import_wp_info()

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

EUVD-2026-80525

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

EUVD-2026-80526

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89926 KVM: s390: Fix length check __import_wp_info()

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

CVE-2026-89926

CVE-2026-89926 affects the Linux kernel KVM s390 subsystem in the __import_wp_info() function. The root cause is a type truncation : the user-space-controlled kvm_hw_breakpoint::len (a __u64) is assigned to wp_info->len (an int). The bounds check evaluates the truncated value, but the subseque...

CVE-2026-89925 KVM: s390: Fix memory leak in guest debug handling

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory leak in guest debug handling bpdata is freed only for the error case by kfreebpdata. Every successful KVMSETGUESTDEBUG will leak bpdata...

CVE-2026-89925

CVE-2026-89925 affects the Linux kernel KVM s390 module. The root cause is a memory leak in the guest debug handling path: bp_data is freed via kfree() only in the error case of KVM_SET_GUEST_DEBUG, so every successful KVM_SET_GUEST_DEBUG call leaks the allocation. The practical impact is a per-c...

CVE-2026-89924

This Linux kernel vulnerability affects the KVM s390 subsystem's guest debug interface. In __import_wp_info(), per-watchpoint old_data buffers are allocated to back up original guest memory contents. When a later watchpoint in the same KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_...

CVE-2026-89924 KVM: s390: Fix old_data leak in guest debug error path

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

EUVD-2026-80524

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix olddata leak in guest debug error path importwpinfo allocates a per-watchpoint olddata buffer to back up the original guest memory contents. If a later watchpoint of the same KVMSETGUESTDEBUG request fails to impor...

CVE-2026-89922 KVM: s390: Take srcu when importing watchpoint data

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data importwpinfo backs up the original guest memory contents of a watchpoint with readguestabs, which is kvmreadguest and therefore resolves the memslot via kvmmemslots. That requir...