CVE-2026-93238: s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: fix potential use of uninitialized apmfiltered bitmap
The DECLAREBITMAP(apmfiltered, APDEVICES) macro allocates the bitmap on the stack without zero-initializing it.
In vfioapmdevhotplugcfg(), the vfioapmdevfiltermatrix() function is only called to initialize and populate apmfiltered if either filteradapters or filterdomains is true. If the hot plug configuration change only adds control domains (meaning filtercdoms is true, but filteradapters and filterdomains are both false), vfioapmdevfiltermatrix() is bypassed.
Consequently, apmfiltered is passed to resetqueuesforapids() with uninitialized stack garbage. This can cause resetqueuesforapids() to interpret arbitrary stack garbage bits as valid APIDs to reset, potentially performing unintended guest hardware queue resets.
Fix this by zero-initializing the apmfiltered bitmap at the beginning of vfioapmdevhotplugcfg() using bitmapzero().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
At the beginning of vfio_ap_mdev_hot_plug_cfg(), zero-initialize the apm_filtered bitmap using bitmap_zero() before vfio_ap_mdev_filter_matrix() or reset_queues_for_apids() uses it.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is in the Linux kernel s390 vfio-ap code path. It is relevant where vfio-ap mediated-device hot-plug configuration changes are used for AP resources.
What configuration change triggers the vulnerable path?
The vulnerable path occurs when a hot-plug configuration change adds only control domains: filter_cdoms is true while filter_adapters and filter_domains are both false. In that case, the bitmap is not populated before it is used.
What could happen if the issue is triggered?
Uninitialized stack bits can be treated as APIDs by reset_queues_for_apids(). This can cause unintended resets of guest hardware queues.
What mitigation is indicated if the fix is not yet available?
Avoid hot-plug configuration changes that add only control domains in vfio-ap mediated-device configurations. The resolved fix zero-initializes the bitmap before it can be passed to the queue-reset function.