A high-severity logic flaw in the Linux kernel s390 vfio-ap subsystem allows for unauthorized control domain persistence, potentially leading to guest-level privilege escalation or data compromise.

The vulnerability stems from an incorrect use of the bitmap_andnot function within the vfio_ap_config_remove function. This error prevents the system from correctly clearing control domains assigned to an mdev, requiring local authenticated access to exploit the resulting configuration state.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for complete compromise of confidentiality, integrity, and availability within the virtualized environment. Because the flaw involves the vfio-ap driver, successful exploitation could allow an attacker with local access to manipulate hardware-assisted virtualization resources, potentially breaking out of expected guest isolation or accessing sensitive control domains that should have been revoked.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.51, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unexpected vfio-ap configuration changes or errors related to mdev removal processes.

Compensating Controls: Limit access to the physical host and restrict the ability to manage vfio-ap devices to only highly trusted administrative accounts to reduce the attack surface.

Public Exploit Available: No

Given the severity of potential guest escape and control domain manipulation, administrators should prioritize kernel updates across all affected s390 architecture deployments. While the exploit requires local access, the impact on virtualized infrastructure is significant, necessitating prompt remediation to maintain the integrity of the virtualization host.