CVE-2026-89957

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vfio ap mdev hot unplug cfg() function where the use of bitmap andnot() to determine if a guest APCB (Advanced Program Console Book) needs updating can lead to skipped hot-unplug operations. When the last adapter, domain, or control domain assigned to an mdev is removed, bitmap andnot() returns false because the resulting destination bitmap is empty. This prevents vfio ap mdev update guest apcb() from being called, which leaves the KVM guest with stale hardware access to the unplugged AP devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.