EUVD-2026-80559
GHSA-8mfq-hrvh-mwqh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local s390 host with vfio-ap configured (AV:L), reached via a privileged admin reconfiguration (PR:H); stale control-domain access breaks guest isolation (S:C) with bounded confidentiality/integrity and no availability impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
The vfio_ap_config_remove function uses the bitmap_andnot function to clear bits from the matrix_mdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmap_and function is used instead.
AnalysisAI
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access when a privileged host administrator unplugs a control domain from a matrix mdev: vfio_ap_mdev_cfg_remove clears the wrong bit set with bitmap_andnot instead of intersecting with bitmap_and on the mdev's adm bitmap. The practical result is that a KVM guest on IBM Z hardware configured for AP (Adjunct Processor) passthrough retains access to control domains the host intended to remove, a residual-access/state-desynchronization condition rather than remote code execution, reached only when a host admin performs an explicit control-domain removal (CVSS 3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an IBM Z / s390 host running the Linux kernel with KVM and the vfio-ap module actively passing AP (Adjunct Processor) crypto adapters and control domains through to a guest via a matrix mdev. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) substantially overstates real-world risk for what is fundamentally a control-flow bug in host reconfiguration logic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - 6.1.188, 6.6.157, 6.12.110, 6.18.51 or 7.2.5 and later (mainline fix present in 7.3-rc1) - or backport the relevant upstream commit from the references (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM Z hosts running Linux kernel with the s390 vfio-ap mdev driver and KVM AP passthrough, confirm whether any host administrator has performed a control-domain removal, and apply the vendor patch for CVE-2026-89959 as specified in your Linux distribution vendor's advisory (Patch available per vendor advisory); if immediate patching is not possible, restrict host administrator control-domain unplug actions and monitor affected guests for unexpected crypto control-domain access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
A use-after-free race in the arm64 KVM vGICv3 code path of the Linux kernel (vgic_v3_save_pending_tables) allows a local
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today