CVE-2026-89959
Description
A flaw was found in the Linux kernel's s390/vfio-ap component. An incorrect function was used during the removal of control domains, specifically bitmap_andnot instead of bitmap_and. This error prevents explicitly unplugged control domains from being properly removed from a Kernel-based Virtual Machine (KVM) guest. This could lead to improper resource management and unexpected behavior within virtualized environments.
Statement
s390/vfio-ap can fail to remove an explicitly unplugged AP control domain from a KVM guest because vfio_ap_mdev_cfg_remove computes the control domain removal mask with bitmap_andnot instead of the intersection of requested removals and assigned domains. A guest that previously had access to an AP control domain may retain that control domain after the host side configuration attempted to remove it, resulting in an authorization revocation failure. For the CVSS the PR:L is used for the paranoid score because the practical attacker is a local guest or tenant context with prior access to the assigned vfio-ap device, not necessarily a fully privileged host administrator. The issue is not network reachable and requires an s390 KVM deployment using vfio-ap and AP crypto resources. Impact is mainly confidentiality and integrity policy bypass for AP control domain isolation, with limited availability impact in the paranoid interpretation.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 8.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | None | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
