{
  "cveId": "CVE-2026-89956",
  "url": "https://patchblox.com/security/cve/CVE-2026-89956",
  "summary": "CVE-2026-89956 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-89956, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects  In order to traverse or add/remove ap_matrix_mdev objects in the matrix_dev-\u003Emdev_list, the matrix_dev-\u003Eguests_lock mutex must be held. There are two functions that access the list without holding the mutex:  vfio_ap_mdev_probe function ~~~~~~~~~~~~~~~~~~~~~~~~~~~ The vfio_ap_mdev_probe function uses the matrix_dev-\u003Emdevs_lock mutex to guard the add of a newly created ap_matrix_mdev object to the matrix_dev-\u003Emdev_list. This mutex does not protect list access; its purpose is to guard against concurrent access to fields contained in an ap_matrix_mdev object. This could lead to kernel memory corruption or use-after-free if another mdev is created or removed concurrently.  The adding of an ap_matrix_mdev object to matrix_dev-\u003Emdev_list is now guarded by the matrix_dev-\u003Eguests_lock which is the correct way to protect against concurrent mdev_list access.  Also removed the following two lines of code because the matrix_mdev is allocated via vfio_alloc_device macro which uses kzalloc, so req_trigger and cfg_chg_trigger are already zero-initialised when the struct is allocated before the call to vfio_register_emulated_iommu_dev. This prevents a window whereby these triggers are set to NULL after the device is exposed to userspace.  matrix_mdev-\u003Ereq_trigger = NULL; matrix_mdev-\u003Ecfg_chg_trigger = NULL;  vfio_ap_mdev_for_queue function ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The status_show function that supports display of the status attribute of the devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue function which iterates the matrix_dev-\u003Emdev_list to find the object representing the queue device whose status is to be displayed. In order to traverse this list, the matrix_dev-\u003Eguests_lock mutex must be held.  To fix this, the guests_lock mutex is taken prior to taking the matrix_dev-\u003Emdevs_lock mutex in the status_show function. It is taken there rather than the vfio_ap_mdev_for_queue function - where it is needed - because it must be taken prior to the mdevs_lock mutex in order to adhere to the proper locking order and prevent a lockdep splat; also because the mdevs_lock is needed there to access fields within the matrix_mdev object in that function.  See the vfio-ap-locking.rst in the linux kernel tree.",
  "published": "2026-09-16T11:17:05Z",
  "severity": "Important",
  "cvss": 7.8,
  "epss": 0.00227,
  "epssPercentile": 0.1351,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-89956",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-89956",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89956",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-89956",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89956",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.113-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-89956",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89956",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}