A use-after-free vulnerability in the Linux kernel s390 vfio-ap driver could allow a local attacker to cause a system crash or execute arbitrary code.

The vulnerability exists in the vfio_ap_mdev_set_kvm function where an error path fails to properly clean up a pqap_hook pointer. This results in a stale pointer reference that can be triggered by a local user, leading to a use-after-free scenario when the associated matrix_mdev is freed.

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk. Because it involves kernel-level memory management, a successful exploit could lead to full system compromise, unauthorized data access, or persistent denial of service. Such flaws are critical in multi-tenant or virtualized environments where guest isolation is paramount.

Immediate Action: Update the Linux kernel to version 6.6.157, 6.12.110, 6.18.51, or 7.2.5, as these versions contain the necessary fix to ensure the pqap_hook pointer is correctly managed.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages specifically related to vfio-ap or PQAP instruction execution, which may indicate attempted exploitation.

Compensating Controls: Restrict access to vfio-ap device interfaces to trusted users only and ensure that hardware-level virtualization security features are enabled and correctly configured to limit the impact of kernel-level faults.

Public Exploit Available: Unknown

Given the severity of this kernel-level flaw, organizations operating s390-based Linux infrastructure should prioritize testing and deploying the provided kernel patches. Immediate application of these updates is the only definitive way to eliminate the risk of memory corruption and potential privilege escalation associated with this vulnerability.