CVE-2026-89957

CVE-2026-89957 affects the Linux kernel s390 vfio-ap driver. In vfio_ap_mdev_hot_unplug_cfg(), the return value of bitmap_andnot() is used to decide whether the guest APCB needs updating. When the last AP adapter or domain assigned to an mdev is removed, the resulting empty bitmap causes bitmap_a...

CVE-2026-89955

A NULL pointer dereference vulnerability exists in the Linux kernel's s390/vfio-ap module. The race occurs when vfio_ap_mdev_probe_queue() creates the sysfs attribute group before the queue's driver data is set; a concurrent read of the status attribute then retrieves NULL via dev_get_drvdata() a...

CVE-2026-89956 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

EUVD-2026-80555

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89956

CVE-2026-89956 affects the s390/vfio-ap subsystem of the Linux kernel. The root cause is a missing matrix_dev->guests_lock mutex when traversing or modifying the mdev_list of ap_matrix_mdev objects. Two functions are affected: vfio_ap_mdev_probe , which added objects to the list using the wron...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

EUVD-2026-80556

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-89956 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of apmatrixmdev objects In order to traverse or add/remove apmatrixmdev objects in the matrixdev-mdevlist, the matrixdev-guestslock mutex must be held. There are two function...

CVE-2026-89777

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

AZL-101571 CVE-2026-89777 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

DEBIAN-CVE-2026-89777

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-89777

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

UBUNTU-CVE-2026-89777

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

EUVD-2026-80298

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-89777 vfio/pci: clear vdev->msi_perm after freeing it on init failure

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-89777

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-89777 vfio/pci: clear vdev->msi_perm after freeing it on init failure

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-89777

A use-after-free vulnerability in the Linux kernel's VFIO/PCI subsystem (drivers/vfio/pci/vfio_pci_config.c) occurs when vdev->msi_perm is freed via kfree() on an init failure path but not NULLed , leaving a dangling pointer that persists across device open/close cycles. On the next vfio_confi...

CVE-2026-89955: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...