CVE-2026-89955: s390/vfio-ap: Fix NULL deref in status_show() during queue probe
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: Fix NULL deref in statusshow() during queue probe
When vfioapmdevprobequeue() creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore call devgetdrvdata() and get NULL, which is then passed directly to vfioapmdevforqueue() where q->apqn is unconditionally dereferenced, causing a NULL pointer dereference.
Fix this by acquiring the update locks before calling sysfscreategroup(). The statusshow() function acquires guestslock before reading the driver data, so any concurrent read will block until after devsetdrvdata() has been called and the update locks are released.
As a bonus, the APQN no longer needs to be read from the queue struct after allocation — it can be read directly from apdev before allocation and stored in a local variable, which is then assigned to q->apqn once the allocation succeeds.
Event History
Frequently Asked Questions
When can this issue be triggered?
It requires a race during vfio_ap_mdev_probe_queue(): the sysfs attribute group must be created while the queue driver data has not yet been set, and another actor must concurrently read the queue's status sysfs attribute.
What is the impact of a successful trigger?
The status read can obtain NULL driver data and pass it to code that unconditionally dereferences the queue APQN field, causing a NULL pointer dereference.
What should be done if the fix cannot be applied immediately?
The provided data identifies concurrent reads of the status sysfs attribute during queue probing as the trigger condition. No specific configuration workaround or mitigation is provided.