# CVE-2026-93238: s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

> A local attacker with high privileges can trigger unintended guest hardware queue resets in the Linux kernel s390/vfio-ap driver due to uninitialized memory usage.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-93238, DEBIAN-CVE-2026-93238, GHSA-q4pw-hxg7-r6v7, UBUNTU-CVE-2026-93238

## What is CVE-2026-93238?

CVE-2026-93238 is an use after free vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

The DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap
on the stack without zero-initializing it.

In vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function
is only called to initialize and populate apm_filtered if either
filter_adapters or filter_domains is true. If the hot plug configuration
change only adds control domains (meaning filter_cdoms is true, but
filter_adapters and filter_domains are both false),
vfio_ap_mdev_filter_matrix() is bypassed.

Consequently, apm_filtered is passed to reset_queues_for_apids() with
uninitialized stack garbage. This can cause reset_queues_for_apids() to
interpret arbitrary stack garbage bits as valid APIDs to reset, potentially
performing unintended guest hardware queue resets.

Fix this by zero-initializing the apm_filtered bitmap at the beginning of
vfio_ap_mdev_hot_plug_cfg() using bitmap_zero().

## Which versions are affected by CVE-2026-93238?


## How do I fix CVE-2026-93238?

Apply the vendor's patch.

## Is CVE-2026-93238 being exploited?

There is no known exploitation of CVE-2026-93238 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-93238 and fix it if it is affected.

What it is: CVE-2026-93238 is an use after free vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-93238 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-93238/ (Markdown: https://insights.sbomify.com/CVE-2026-93238/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-93238
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93238
- OSV: https://osv.dev/vulnerability/CVE-2026-93238

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-93238/
Summaries are generated and may contain mistakes; the official description above is the record.