Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98473

Vulnerability identifier: #VU156771

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98473

CWE-ID: CWE-772

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to potentially cause a denial of service through leaked host resources.

The vulnerability exists due to missing resource release in the Linux kernel s390 vfio-ap function vfio_ap_mdev_reset_queue() when a queue reset returns AP_RESPONSE_Q_NOT_AVAIL during removal from the host's AP configuration. A local user can use a guest with interrupt handling enabled for the assigned queue under these removal conditions to leave KVM GISC registrations and pinned guest notification pages unreleased, potentially exhausting host resources.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/3c3433657c82f200dae36c29e2b80681c81b85be
• https://git.kernel.org/stable/c/65e05ec252a9b79e75930d3c4dd42d8877db04c5
• https://git.kernel.org/stable/c/cf441a0db681dfad5e89b015d6be11365159d7a9
• https://git.kernel.org/stable/c/da69d3ac53490724eba0ade9deb4e539a6ae9034

• Missing Release of Resource after Effective Lifetime in Linux kernel s390 crypto driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more