CVE-2026-89955s390/vfio-ap: Fix NULL deref in status_show() during queue probe
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in status_show() during queue probe When vfio_ap_mdev_probe_queue() creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore call dev_get_drvdata() and get NULL, which is then passed directly to vfio_ap_mdev_for_queue() where q->apqn is unconditionally dereferenced, causing a NULL pointer dereference. Fix this by acquiring the update locks before calling sysfs_create_group(). The status_show() function acquires guests_lock before reading the driver data, so any concurrent read will block until after dev_set_drvdata() has been called and the update locks are released. As a bonus, the APQN no longer needs to be read from the queue struct after allocation — it can be read directly from apdev before allocation and stored in a local variable, which is then assigned to q->apqn once the allocation succeeds.
Timeline
ID reserved
By Linux
- 5 days later
· 5 days later
Published
- 44 days later
· 44 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 260f3ea141382386e97611e7c2029bc013088ab1 – < 10606c9af18baed75cd180b96ee695441aa15134
- affected 260f3ea141382386e97611e7c2029bc013088ab1 – < 31fa0a8a3c337ed2d200166d6926ab23c14f8b2e
- affected 260f3ea141382386e97611e7c2029bc013088ab1 – < e102ce0f4af99dff769a4b1b4daa4cc6bd5ad2d9
- affected 260f3ea141382386e97611e7c2029bc013088ab1 – < 69632952aca04caa71e49953b6949fc04e788e67
- affected 260f3ea141382386e97611e7c2029bc013088ab1 – < 7db2511fc601ca3a6e3fb1bdce02261c3c3167c3
- affected 260f3ea141382386e97611e7c2029bc013088ab1 – < dd6f4ef6f8a37412909ad787c837332fb070159c
- affected 6.0
- unaffected < 6.0
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.51 – ≤ 6.18.*
- unaffected 7.2.5 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/10606c9af18baed75cd180b96ee695441aa15134 (opens in a new tab)
- https://git.kernel.org/stable/c/31fa0a8a3c337ed2d200166d6926ab23c14f8b2e (opens in a new tab)
- https://git.kernel.org/stable/c/e102ce0f4af99dff769a4b1b4daa4cc6bd5ad2d9 (opens in a new tab)
- https://git.kernel.org/stable/c/69632952aca04caa71e49953b6949fc04e788e67 (opens in a new tab)
- https://git.kernel.org/stable/c/7db2511fc601ca3a6e3fb1bdce02261c3c3167c3 (opens in a new tab)
- https://git.kernel.org/stable/c/dd6f4ef6f8a37412909ad787c837332fb070159c (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-80555 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89955)Record last updated .