CVE-2026-53116: s390/ap: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved:
s390/ap: use generic driveroverride infrastructure
When the AP masks are updated via apmaskstore() or aqmaskstore(), apbusrevisebindings() is called after apattrmutex has been released.
This calls aprevisereserved(), which accesses the driveroverride field without holding any lock, racing against a concurrent driveroverridestore() that may free the old string, resulting in a potential UAF.
Fix this by using the driver-core driveroverride infrastructure, which protects all accesses with an internal spinlock.
Note that unlike most other buses, the AP bus does not check driveroverride in its match() callback; the override is checked in apdeviceprobe() and aprevisereserved() instead.
Also note that we do not enable the driveroverride feature of struct bustype, as AP - in contrast to most other buses - passes "" to sysfsemit() when the driveroverride pointer is NULL. Thus, printing "\n" instead of "(null)\n".
Additionally, AP has a custom counter that is modified in the corresponding custom driveroverridestore().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53116?
CVE-2026-53116 has a risk rating of 37, indicating a moderate level of severity.
How do I fix CVE-2026-53116?
To mitigate CVE-2026-53116, you should update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-53116?
CVE-2026-53116 affects the Linux kernel specifically in the s390/ap subsystem.
What is the nature of CVE-2026-53116?
CVE-2026-53116 is a vulnerability that occurs due to improper handling of AP masks in the Linux kernel.
Was CVE-2026-53116 publicly disclosed?
Yes, CVE-2026-53116 was publicly disclosed on June 24, 2026.