All vulnerabilities
CVE-2026-93238

Linux: s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2Also 6d554f2571e6b4db242593ba561efd6a6d1f99a9, 09548edc6114f1eb1035b30795e893204ef45b85CVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2LinuxCVE List
  • 6d554f2571e6b4db242593ba561efd6a6d1f99a9LinuxCVE List
  • 09548edc6114f1eb1035b30795e893204ef45b85LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

The DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap on the stack without zero-initializing it.

In vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function is only called to initialize and populate apm_filtered if either filter_adapters or filter_domains is true. If the hot plug configuration change only adds control domains (meaning filter_cdoms is true, but filter_adapters and filter_domains are both false), vfio_ap_mdev_filter_matrix() is bypassed.

Consequently, apm_filtered is passed to reset_queues_for_apids() with uninitialized stack garbage. This can cause reset_queues_for_apids() to interpret arbitrary stack garbage bits as valid APIDs to reset, potentially performing unintended guest hardware queue resets.

Fix this by zero-initializing the apm_filtered bitmap at the beginning of vfio_ap_mdev_hot_plug_cfg() using bitmap_zero().

Text from CVE List

Affected versions 12

  • Linuxaffected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 before 4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2CVE List
  • Linuxaffected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 before f73db632524320d2b93bc8534be8ea875053502dCVE List
  • Linuxaffected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 before 6d554f2571e6b4db242593ba561efd6a6d1f99a9CVE List
  • Linuxaffected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 before 09548edc6114f1eb1035b30795e893204ef45b85CVE List
  • Linuxaffected: eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 before bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7CVE List
  • Linuxaffected: 6.0CVE List
  • Linuxunaffected: all versions before 6.0CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.51 through 6.18.*CVE List
  • Linuxunaffected: 7.2.5 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5