CVE-2024-26620 is a vulnerability identified in the Linux kernel's s390 architecture VFIO AP (Virtual Function I/O Adapter Processor) mediated device (mdev) implementation. The vulnerability arises from improper filtering of the AP (Adapter Processor) matrix when assigning adapters or domains to a mediated device. Specifically, the function vfio_ap_mdev_filter_matrix is responsible for updating the guest virtual machine's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. However, the flawed logic inspects only the APIDs (Adapter Processor Identifiers) of the newly assigned adapter or APQIs (Adapter Processor Queue Identifiers) of the newly assigned domain, rather than inspecting all adapters and domains assigned to the mdev. This selective inspection can lead to a scenario where AP queues that are not bound to the vfio_ap device driver are incorrectly passed through to the guest VM. For example, if a domain is unassigned and then reassigned, only that domain's APQNs are inspected, potentially allowing queues like 16.0005 that are unbound to the vfio_ap driver to be accessible by the guest. This behavior violates the Linux device model's security requirement that guests should only have access to devices bound to the device driver managing their pass-through. The fix involves modifying the filtering logic to inspect every adapter and domain assigned to the mdev, ensuring that only properly bound devices are exposed to the guest. This vulnerability affects Linux kernel versions identified by the commit hash 48cae940c31d2407d860d87c41d5f9871c0521db and was published on February 29, 2024. There are no known exploits in the wild at this time, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to environments running Linux on IBM Z (s390) architecture systems that utilize VFIO mediated devices for device pass-through to virtual machines. The improper filtering could allow unauthorized access to hardware queues by guest VMs, potentially leading to unauthorized data access or manipulation at the hardware interface level. This could compromise the confidentiality and integrity of data processed by affected virtual machines. Additionally, it could lead to stability or availability issues if unauthorized device access causes conflicts or resource contention. Organizations relying on s390 Linux systems for critical workloads, such as financial institutions, government agencies, and large enterprises in Europe, may face increased risk if they use virtualization technologies that expose hardware devices via VFIO mediated devices. While the vulnerability does not currently have known exploits, the potential for privilege escalation or data leakage in multi-tenant or sensitive environments makes timely patching important. The impact is more pronounced in sectors with high reliance on mainframe or s390 architecture virtualization, which are more common in certain European countries with established IBM mainframe usage.

European organizations using Linux on s390 architecture should promptly apply the patch that updates the vfio_ap_mdev_filter_matrix function to inspect all adapters and domains assigned to the mediated device, ensuring proper filtering of AP queues. Since the vulnerability involves kernel-level device driver logic, updating to the fixed Linux kernel version containing commit 48cae940c31d2407d860d87c41d5f9871c0521db is essential. Organizations should: 1) Identify all s390 Linux systems running VFIO mediated devices and assess their exposure. 2) Schedule and perform kernel updates during maintenance windows to minimize disruption. 3) Review virtualization configurations to ensure that device pass-through policies strictly enforce device-driver binding requirements. 4) Monitor system logs for unusual device assignment or binding events that could indicate exploitation attempts. 5) Implement strict access controls and segmentation for virtual machines using VFIO devices to limit potential lateral movement. 6) Engage with Linux distribution vendors for backported patches if using enterprise Linux variants. These steps go beyond generic advice by focusing on architecture-specific mitigation and operational controls tailored to the vulnerability's nature.