Linux Kernel CVE-2026-53116

The affected component is the s390/ap (Adjunct Processor) bus, the Linux kernel subsystem that mediates access to cryptographic coprocessors/HSM adapters on IBM Z (s390x) mainframes. Administrators partition AP adapters and queues between the host and guests using bitmask sysfs attributes (apmask/aqmask), and can bind specific AP devices to drivers using the generic sysfs driver_override attribute. The root cause is CWE-416 Use-After-Free: the AP bus implemented driver_override handling with a custom store routine and a custom counter, but read the driver_override pointer in __ap_revise_reserved() (reached via ap_bus_revise_bindings() after ap_attr_mutex was released) without any lock, while a concurrent driver_override_store() could free the previous override string. Unlike most buses, AP does not consult driver_override in its match() callback - the override is instead evaluated in ap_device_probe() and __ap_revise_reserved() - and it deliberately emits an empty string rather than '(null)' when the override is unset, which is why the fix keeps a custom store while delegating pointer lifetime/locking to the driver-core's spinlock-protected driver_override infrastructure.