{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89956 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89956 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89956 and fix it if it is affected.\n\nWhat it is: CVE-2026-89956 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89956 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89956/ (Markdown: https://insights.sbomify.com/CVE-2026-89956/index.md)","id":"CVE-2026-89956","markdown":"https://insights.sbomify.com/CVE-2026-89956/index.md","name":"CVE-2026-89956","record":{"aliases":["AZL-101556","BELL-CVE-2026-89956","DEBIAN-CVE-2026-89956","GHSA-vvfx-87j6-h3vv","UBUNTU-CVE-2026-89956"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"high_privilege","summary":"A race condition in the s390/vfio-ap kernel driver allows local attackers to cause memory corruption or use-after-free, potentially leading to privilege escalation.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects\n\nIn order to traverse or add/remove ap_matrix_mdev objects in the\nmatrix_dev-\u003emdev_list, the matrix_dev-\u003eguests_lock mutex must be held.\nThere are two functions that access the list without holding the mutex:\n\nvfio_ap_mdev_probe function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe vfio_ap_mdev_probe function uses the matrix_dev-\u003emdevs_lock\nmutex to guard the add of a newly created ap_matrix_mdev object to the\nmatrix_dev-\u003emdev_list. This mutex does not protect list access; its purpose\nis to guard against concurrent access to fields contained in an\nap_matrix_mdev object. This could lead to kernel memory corruption or\nuse-after-free if another mdev is created or removed concurrently.\n\nThe adding of an ap_matrix_mdev object to matrix_dev-\u003emdev_list\nis now guarded by the matrix_dev-\u003eguests_lock which is the correct\nway to protect against concurrent mdev_list access.\n\nAlso removed the following two lines of code because the matrix_mdev is\nallocated via vfio_alloc_device macro which uses kzalloc, so req_trigger\nand cfg_chg_trigger are already zero-initialised when the struct is\nallocated before the call to vfio_register_emulated_iommu_dev. This\nprevents a window whereby these triggers are set to NULL after\nthe device is exposed to userspace.\n\nmatrix_mdev-\u003ereq_trigger = NULL;\nmatrix_mdev-\u003ecfg_chg_trigger = NULL;\n\nvfio_ap_mdev_for_queue function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe status_show function that supports display of the status attribute of\nthe devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue\nfunction which iterates the matrix_dev-\u003emdev_list to find the object\nrepresenting the queue device whose status is to be displayed. In order to\ntraverse this list, the matrix_dev-\u003eguests_lock mutex must be held.\n\nTo fix this, the guests_lock mutex is taken prior to taking the\nmatrix_dev-\u003emdevs_lock mutex in the status_show function. It is taken\nthere rather than the vfio_ap_mdev_for_queue function - where it is\nneeded - because it must be taken prior to the mdevs_lock mutex in order to\nadhere to the proper locking order and prevent a lockdep splat; also\nbecause the mdevs_lock is needed there to access fields within\nthe matrix_mdev object in that function.\n\nSee the vfio-ap-locking.rst in the linux kernel tree.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects","id":"CVE-2026-89956","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed","id":"CVE-2026-89957"},"packages":[],"prev":{"headline":"s390/vfio-ap: Fix NULL deref in status_show() during queue probe","id":"CVE-2026-89955"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A race condition in the s390/vfio-ap kernel driver allows local attackers to cause memory corruption or use-after-free, potentially leading to privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-89956/"}