CVE-2026-89957: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
The vfioapmdevhotunplugcfg() function uses the return value of bitmapandnot() to determine whether the guest APCB needs to be updated. However, bitmapandnot() returns false when the resulting destination bitmap is empty. This means that if the only adapter, domain or control domain assigned to an mdev is removed from the host's AP configuration, the bit is correctly cleared from the shadow APCB, but bitmapandnot() returns false because the result is an empty bitmap. Consequently, dohotplug remains 0 and vfioapmdevupdateguestapcb() is never called, leaving the KVM guest with stale hardware access to the unplugged AP devices.
Fix this by replacing the bitmapandnot() return value check with bitmapintersects() to determine whether the shadow APCB actually overlaps with the removal mask. If there is an intersection, call bitmapandnot() solely for its side effect of clearing the bits, then unconditionally set dohotplug to trigger the guest APCB update.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue applies to Linux kernel systems using s390 vfio-ap mediated devices with KVM guests. It is triggered when the last assigned AP adapter, domain, or control domain is removed from the host AP configuration.
What is the impact when the condition occurs?
The guest APCB is not updated after the final assigned AP resource is removed. The KVM guest can therefore retain stale hardware access to AP devices that were unplugged from the host configuration.
How can I tell whether a guest may be affected?
A potentially affected configuration has a vfio-ap mediated device whose final assigned adapter, domain, or control domain was removed while a KVM guest was using it. In that case, the guest may still have access because the guest APCB update was skipped.