CVE-2026-89959: s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
Published Sep 16, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove
The vfioapconfigremove function uses the bitmapandnot function to clear bits from the matrixmdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmapand function is used instead.
Affected Software
1 affected component
Linux Kernel
Event History
Sep 16, 2026
CVE Published
via MITRE·10:32 AM
Data Sourced
via MITRE·10:32 AM
Description
Frequently Asked Questions
1
Which deployments are relevant to this issue?
It is relevant to Linux Kernel deployments on s390 that use vfio-ap mediated-device configuration and assign control domains to an mdev for a KVM guest.
2
How can an administrator tell whether the issue is occurring?
Affected behavior is indicated when explicitly unplugged control domains remain assigned to the KVM guest instead of being removed.