UBUNTU-CVE-2026-89959: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the matrixmdev->matrix.adm bitmap (specifies the control domains assigned to the mdev). This prevents the explicitly unplugged control domains from being removed the KVM guest. The bitmapand function is used instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which deployments are relevant to this issue?
The issue is relevant to systems using the s390 vfio-ap driver with mediated devices that have control domains assigned, particularly where those domains are explicitly unplugged from KVM guests. The listed Ubuntu kernel packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What access does an attacker need?
The supplied severity vector indicates local access, low attack complexity, and low privileges required, with no user interaction. It also indicates a scope change and high confidentiality, integrity, and availability impact.
How can I determine whether the fix is present?
Inspect the vfio_ap_mdev_cfg_remove handling in vfio_ap_config_remove. The corrected code uses bitmap_and when clearing explicitly unplugged control-domain bits from matrix_mdev->matrix.adm; the vulnerable behavior used bitmap_andnot.