Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-89960

s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()

CVSS 8.8 HighEPSS 0.0017 · 6th percentile

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:32 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 86956e70761b3292156d668e87126844334dd71b to before d6b7b166d5310fa3e4d5802c4177a0264d9140bd git
  • affected 86956e70761b3292156d668e87126844334dd71b to before eb6cc898501a004c0fa8aab951351d9c959b91cc git
  • affected 86956e70761b3292156d668e87126844334dd71b to before 6a180adafc2a8a5fbe815985c71b2201e93ab5e1 git
  • affected 86956e70761b3292156d668e87126844334dd71b to before fc069d00a0dbef40042fd681554d48dcd5a1d524 git
  • affected 86956e70761b3292156d668e87126844334dd71b to before 13bfc94eef389bd664ffc67b00184919902c938a git
  • affected 86956e70761b3292156d668e87126844334dd71b to before 4400270ec0348d05dc0439d8f0130853ce7f9e20 git
Other versions: unaffected
Linux Linux
  • affected 5.15
  • unaffected before 5.15 semver
  • unaffected 6.1.191 to 6.1.*, inclusive semver
  • unaffected 6.6.157 to 6.6.*, inclusive semver
  • unaffected 6.12.110 to 6.12.*, inclusive semver
  • unaffected 6.18.51 to 6.18.*, inclusive semver
  • unaffected 7.2.5 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-89960
CNA
Linux
Tags
Published
16 Sept 2026
Updated
30 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.8 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0017, the 6th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.