A logic flaw in the Linux kernel s390 vfio-ap driver may result in stale hardware access for KVM guests, posing a significant security risk.

The vfio_ap_mdev_hot_unplug_cfg function incorrectly handles bitmap operations when the last AP adapter or domain is removed, failing to trigger a guest APCB update. This requires local, authenticated access to the system to trigger the race or state-handling condition.

The vulnerability allows a KVM guest to maintain access to hardware devices that have been logically removed from the host configuration. This unauthorized access can lead to potential data leakage or integrity issues between virtual machines or between a virtual machine and the host. With a CVSS score of 8.8, this flaw represents a high risk to multi-tenant environments relying on VFIO for hardware passthrough.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.51, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for errors related to vfio-ap or KVM device passthrough, specifically looking for failures in hot-plug or hot-unplug event handling.

Compensating Controls: Restrict access to the host system to prevent unauthorized users from manipulating device configurations or triggering hardware hot-unplug events.

Public Exploit Available: Unknown.

Given the potential for unauthorized hardware access in virtualized environments, this vulnerability should be prioritized for patching. Administrators should verify their current kernel version against the provided fixed releases and apply the necessary updates to ensure that hardware isolation is maintained during device hot-unplug operations.