PT-2026-116692 · Linux · Linux
CVE-2026-98473
·
تاريخ النشر
2026-10-18
·
تاريخ التحديث
2026-10-18
لا يوجد
لا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
Three related problems exist in the handling of KVM interrupt and page
resources when a queue is removed from the host's AP configuration
while assigned to a mediated device (mdev).
Problem 1:
AP RESPONSE Q NOT AVAIL not handled in vfio ap mdev reset queue()
When the AP bus removes a queue device whose adapter or domain has
been removed from the host's AP configuration,
vfio ap mdev remove queue() is called. If the queue is still in the
host's AP configuration at that point, it calls
vfio ap mdev reset queue(), which issues a PQAP(ZAPQ). Since the
adapter is already gone from the host configuration, ap zapq() returns
AP RESPONSE Q NOT AVAIL (0x01). This response code is not handled in
vfio ap mdev reset queue()'s switch statement and falls through to
the default case, which issues a WARN but does not call
vfio ap free aqic resources(). As a result, if IRQ handling was
enabled for the queue by the guest, the KVM GISC registration and
the pinned guest page holding the notification indicator byte (NIB)
are both leaked.
This is fixed by adding AP RESPONSE Q NOT AVAIL to the same case as
AP RESPONSE DECONFIGURED and AP RESPONSE CHECKSTOPPED in
vfio ap mdev reset queue(). Like those response codes, Q NOT AVAIL
indicates the queue is not operational and no further reset attempts
are possible; the correct action is to free the IRQ resources
immediately.
Problem 2:AP RESPONSE Q NOT AVAIL not handled in apq status check()
In vfio ap mdev reset queue(), there are four cases that indicate a queue
reset has not yet completed, in which case apq reset check() is queued to
a work queue to verify completion of the reset operation. This function
uses the PQAP(TAPQ) function to get the queue's status and calls
apq status check() to verify whether the reset has completed, failed or
needs to be executed again. As described in Problem #1 above,
apq reset check() does not specifically check for AP RESPONSE Q NOT AVAIL,
thereby potentially leaking KVM GISC registration and the pinned guest page
holding the NIB.
This is fixed by adding a case statement for AP RESPONSE Q NOT AVAIL to
apq status check() and returning -ENODEV for that case. The caller,
apq reset check() will then check for this return code and call
vfio ap free aqic resources() to prevent the leak.
Problem 3:
vfio ap free aqic resources() leaks saved isc when kvm is NULL
vfio ap free aqic resources() guards the call to
kvm s390 gisc unregister() with:
if (q->saved isc != VFIO AP ISC INVALID &&
!WARN ON(!(q->matrix mdev && q->matrix mdev->kvm)))
If matrix mdev->kvm is NULL -- which can happen when
vfio ap mdev unset kvm() has already run and cleared kvm before a
subsequent cleanup path reaches this function -- the WARN ON fires
and the entire block is skipped. This leaves q->saved isc set to a
non-invalid value, creating a potential double-free on any subsequent
call to this function.
When kvm is NULL the KVM guest is already torn down, so
kvm s390 gisc unregister() need not and cannot be called; however,
q->saved isc must always be cleared. Fix this by separating the
kvm s390 gisc unregister() call from the q->saved isc reset. The
WARN ON now guards only the genuinely impossible case of matrix mdev
being NULL. A NULL kvm is handled gracefully by skipping only the
unregister call, and q->saved isc = VFIO AP ISC INVALID is set
unconditionally whenever saved isc was not already invalid.
Additionally, add an else clause to the host-config check in
vfio ap mdev remove queue() to call vfio ap free aqic resources()
directly when the queue is not in the host's AP configuration. This
serves as a backstop: when the AP bus fires the driver .remove
callback after an adapter is removed from the host config, the queue
is by definition no longer addressable, so vfio ap mdev reset queue
---truncated--- وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Linux