{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89960 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89960 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89960 and fix it if it is affected.\n\nWhat it is: CVE-2026-89960 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89960 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89960/ (Markdown: https://insights.sbomify.com/CVE-2026-89960/index.md)","id":"CVE-2026-89960","markdown":"https://insights.sbomify.com/CVE-2026-89960/index.md","name":"CVE-2026-89960","record":{"aliases":["AZL-101528","BELL-CVE-2026-89960","DEBIAN-CVE-2026-89960","GHSA-gfv9-x355-hv69","UBUNTU-CVE-2026-89960"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel's s390/vfio-ap driver allows guest code execution or privilege escalation via a stale pointer dereference.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()\n\nIn vfio_ap_mdev_set_kvm(), kvm-\u003earch.crypto.pqap_hook is set to\n\u0026matrix_mdev-\u003epqap_hook before the update locks are acquired and the\nmdev list is checked for a conflicting assignment. If another mdev is\nalready attached to the same KVM instance, the function returns -EPERM\nwithout restoring the hook pointer, leaving kvm-\u003earch.crypto.pqap_hook\npointing at the failing matrix_mdev instead of the mdev that legitimately\nowns the KVM.\n\nSince matrix_mdev-\u003ekvm is never set on this error path,\nvfio_ap_mdev_unset_kvm() will not clean up the hook when matrix_mdev\nis later closed. If matrix_mdev is subsequently freed, any PQAP\ninstruction executed by the guest will dereference the stale pointer\nthrough pqap_hook_rwsem, resulting in a use-after-free.\n\nSince kvm-\u003earch.crypto.pqap_hook is only set in the vfio_ap_mdev_set_kvm()\nfunction and is cleared in the vfio_ap_mdev_unset_kvm() function, a check\nfor 'kvm-\u003earch.crypto.pqap_hook != NULL' is all that is needed to determine\nwhether it belongs to another mdev. This will alleviate the need to iterate\nthe matrix_dev-\u003emdev_list list to see if the kvm object is assigned to\nanother mdev.This was introduced in v3 to alleviate the need to take the\nmdevs_lock while iterating the list; however, this did not prevent a\npotential race condition.\n\nThe pqap_hook_rwsem(write) is now performed inside\nget_update_locks_for_kvm(), which is updated to acquire\npqap_hook_rwsem(write) between kvm-\u003elock and mdevs_lock. This ordering\nis consistent with the PQAP intercept path, which acquires pqap_hook_rwsem\nin read mode while srcu is held under vcpu-\u003emutex, establishing the\ndependency: kvm-\u003elock -\u003e vcpu-\u003emutex -\u003e srcu -\u003e pqap_hook_rwsem(read).\n\nThe pqap_hook_rwsem is now released inside the\nrelease_update_locks_for_kvm(), which is updated to release\npqap_hook_rwsem(write) between mdevs_lock and kvm-\u003elock.\n\nAdditionally, kvm_put_kvm() in vfio_ap_mdev_unset_kvm() is moved\nafter release_update_locks_for_kvm(). Previously it was called while\nkvm-\u003elock was held; if it were ever the last reference, kvm_destroy_vm()\nwould run under kvm-\u003elock, which would deadlock.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()","id":"CVE-2026-89960","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population","id":"CVE-2026-89961"},"packages":[],"prev":{"headline":"s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove","id":"CVE-2026-89959"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel's s390/vfio-ap driver allows guest code execution or privilege escalation via a stale pointer dereference.","url":"https://insights.sbomify.com/CVE-2026-89960/"}