{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89958 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89958 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89958 and fix it if it is affected.\n\nWhat it is: CVE-2026-89958 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89958 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89958/ (Markdown: https://insights.sbomify.com/CVE-2026-89958/index.md)","id":"CVE-2026-89958","markdown":"https://insights.sbomify.com/CVE-2026-89958/index.md","name":"CVE-2026-89958","record":{"aliases":["AZL-101511","BELL-CVE-2026-89958","DEBIAN-CVE-2026-89958","GHSA-hgjh-2rgq-2xcv","UBUNTU-CVE-2026-89958"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can cause a denial of service in the Linux kernel by triggering a NULL pointer dereference in the s390/vfio-ap driver.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: Fix dereference matrix_mdev-\u003ekvm without checking for NULL\n\nThe ap_driver structure has two fields which are function pointers to\ncallbacks:\n\n* .on_config_changed: called at the start of the AP bus scan function to\n                      notify the device driver that the host AP\n                      configuration has changed and the associated AP\n                      devices will be added or removed accordingly. This\n                      gives the implementor a chance to evaluate the\n                      configuration changes and respond to them before\n                      the associated devices are added or removed.\n\n* .on_scan_complete:  Called at the end of the AP bus scan function to\n                      notify the device driver that the host AP\n                      configuration has changed and the AP devices have\n                      been added or removed accordingly. This gives the\n                      implementor the opportunity to respond to the\n                      changes after the associated devices are added or\n                      removed.\n\nThese two callbacks are implemented in the vfio_ap device driver via the\nvfio_ap_on_cfg_changed and vfio_ap_on_scan_complete functions respectively.\n\nWithin the call stack of these two callback functions the\nmatrix_mdev-\u003ekvm-\u003elock mutex is taken without checking whether\nmatrix_mdev-\u003ekvm is NULL or not. If matrix_mdev-\u003ekvm has never been set,\ntrying to take the lock will trigger a NULL pointer dereference. This patch\nadds checks for matrix_mdev-\u003ekvm == NULL before taking the\nmatrix_mdev-\u003ekvm-\u003elock mutex.\n\nNote that the matrix_mdev-\u003ekvm-\u003elock mutex taken in the\nvfio_ap_mdev_hot_plug_config function is moved to the calling function\nalong with the matrix_dev-\u003emdevs_lock which is needed there to access\nthe fields of the matrix_mdev. It makes little sense to make the change\nthe check for matrix_mdev-\u003ekvm there before taking the kvm-\u003elock\nmutex only to have to move it out via another patch, so it is done in\nthis patch.\n\nIt is important to make note of the following:\n1. The matrix_dev-\u003eguests_lock is acquired at the start of both callback\n   functions. This ensures that matrix_mdev will not be removed via the\n   vfio_ap_mdev_remove function because it too takes matrix_dev_guests_lock\n   before removing the object; so, matrix_mdev will be available for the\n   duration of the callback functions.\n\n2. The matrix_dev-\u003emdevs_lock mutex must be taken in order to access\n   fields within the matrix_mdev structure\n\n3. matrix_mdev-\u003ekvm-\u003elock mutex must be taken before the\n   matrix_dev-\u003emdevs_lock to prevent a lockdep splat.\n\n4: The kvm-\u003elock must be held while plugging the guest's AP configuration\n   into its SIE state description via the vfio_ap_mdev_update_guest_apcb\n   function.\n\n5. The vfio_ap_mdev_update_guest_apcb checks matrix_mdev-\u003ekvm to verify it\n   is not NULL before doing the hot plug of the guest's AP configuration.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"s390/vfio-ap: Fix dereference matrix_mdev-\u003ekvm without checking for NULL","id":"CVE-2026-89958","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove","id":"CVE-2026-89959"},"packages":[],"prev":{"headline":"s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed","id":"CVE-2026-89957"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker can cause a denial of service in the Linux kernel by triggering a NULL pointer dereference in the s390/vfio-ap driver.","url":"https://insights.sbomify.com/CVE-2026-89958/"}