UBUNTU-CVE-2026-93238: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix potential use of uninitialized apmfiltered bitmap The DECLAREBITMAP(apmfiltered, APDEVICES) macro allocates the bitmap on the stack without zero-initializing it. In vfioapmdevhotplugcfg(), the vfioapmdevfiltermatrix() function is only called to initialize and populate apmfiltered if either filteradapters or filterdomains is true. If the hot plug configuration change only adds control domains (meaning filtercdoms is true, but filteradapters and filterdomains are both false), vfioapmdevfiltermatrix() is bypassed. Consequently, apmfiltered is passed to resetqueuesforapids() with uninitialized stack garbage. This can cause resetqueuesforapids() to interpret arbitrary stack garbage bits as valid APIDs to reset, potentially performing unintended guest hardware queue resets. Fix this by zero-initializing the apmfiltered bitmap at the beginning of vfioapmdevhotplugcfg() using bitmapzero().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Call bitmap_zero() at the beginning of vfio_ap_mdev_hot_plug_cfg() to zero-initialize the apm_filtered bitmap before it is passed to reset_queues_for_apids().
Linux kernel s390/vfio-ap apm_filtered initialization in vfio_ap_mdev_hot_plug_cfg() = zero-initialized
Event History
Frequently Asked Questions
What configuration change triggers the uninitialized bitmap path?
The affected path is reached when a VFIO AP mediated-device hot-plug configuration change adds control domains only. In that case, filter_cdoms is true while both filter_adapters and filter_domains are false, so the bitmap is not populated before it is used.
What is the operational impact if this path is triggered?
Arbitrary stack bits can be interpreted as valid APIDs by reset_queues_for_apids(). This can result in unintended resets of guest hardware queues.
Does the provided information indicate a remote or unauthenticated attack vector?
No. The provided data describes a kernel bug during VFIO AP mediated-device hot-plug configuration handling, but does not identify a remote, unauthenticated, or external attacker vector.