SB2026102243 - Missing Release of Resource after Effective Lifetime in Linux kernel s390 crypto driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98473)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through leaked host resources.

The vulnerability exists due to missing resource release in the Linux kernel s390 vfio-ap function vfio_ap_mdev_reset_queue() when a queue reset returns AP_RESPONSE_Q_NOT_AVAIL during removal from the host's AP configuration. A local user can use a guest with interrupt handling enabled for the assigned queue under these removal conditions to leave KVM GISC registrations and pinned guest notification pages unreleased, potentially exhausting host resources.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3c3433657c82f200dae36c29e2b80681c81b85be
• https://git.kernel.org/stable/c/65e05ec252a9b79e75930d3c4dd42d8877db04c5
• https://git.kernel.org/stable/c/cf441a0db681dfad5e89b015d6be11365159d7a9
• https://git.kernel.org/stable/c/da69d3ac53490724eba0ade9deb4e539a6ae9034