CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
A local attacker with access to s390/vfio-ap sysfs attributes can trigger a NULL pointer dereference, causing a kernel crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89955?
CVE-2026-89955 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
When vfio_ap_mdev_probe_queue() creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore call dev_get_drvdata() and get NULL, which is then passed directly to vfio_ap_mdev_for_queue() where q->apqn is unconditionally dereferenced, causing a NULL pointer dereference.
Fix this by acquiring the update locks before calling sysfs_create_group(). The status_show() function acquires guests_lock before reading the driver data, so any concurrent read will block until after dev_set_drvdata() has been called and the update locks are released.
As a bonus, the APQN no longer needs to be read from the queue struct after allocation — it can be read directly from apdev before allocation and stored in a local variable, which is then assigned to q->apqn once the allocation succeeds.
Which versions are affected by CVE-2026-89955?
How do I fix CVE-2026-89955?
Apply the vendor's patch.
Is CVE-2026-89955 being exploited?
There is no known exploitation of CVE-2026-89955 in the wild and no public exploit code.
Sources
Also known as AZL-101202, BELL-CVE-2026-89955, DEBIAN-CVE-2026-89955, GHSA-6vjc-f3pw-3x6w, UBUNTU-CVE-2026-89955.