VulnerabilityPublished 24 Sep 2026Updated 19 Oct 2026

CVE-2026-93238: Linux kernel · s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f73db632524320d2b93bc8534be8ea875053502d : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f73db632524320d2b93bc8534be8ea875053502d, bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7, 09548edc6114f1eb1035b30795e893204ef45b85 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ eeb386aeb5b7c8d2dae6a3ba49255d8a97803182, < f73db632524320d2b93bc8534be8ea875053502d	Fixed in f73db632524320d2b93bc8534be8ea875053502d
LinuxLinux	Affected ≥ eeb386aeb5b7c8d2dae6a3ba49255d8a97803182, < bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7	Fixed in bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7
LinuxLinux	Affected ≥ eeb386aeb5b7c8d2dae6a3ba49255d8a97803182, < 09548edc6114f1eb1035b30795e893204ef45b85	Fixed in 09548edc6114f1eb1035b30795e893204ef45b85
LinuxLinux	Affected ≥ eeb386aeb5b7c8d2dae6a3ba49255d8a97803182, < 6d554f2571e6b4db242593ba561efd6a6d1f99a9	Fixed in 6d554f2571e6b4db242593ba561efd6a6d1f99a9
LinuxLinux	Affected ≥ eeb386aeb5b7c8d2dae6a3ba49255d8a97803182, < 4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2	Fixed in 4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2
LinuxLinux	Affected =6.0	Fixed in–

AI-suggested

A patch is available and has been applied in the Linux kernel. Users should update to a fixed kernel version containing the commit that zero-initializes the apm_filtered bitmap. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.

Description

A vulnerability in the Linux kernel's s390 vfio-ap driver involves the use of an uninitialized bitmap variable, apm_filtered, which can lead to unintended guest hardware queue resets. The issue arises because the bitmap is allocated on the stack without zero-initialization and may be passed with arbitrary stack data to a reset function. This has been fixed by zero-initializing the bitmap at the start of the relevant function.

Impact

The vulnerability can cause the Linux kernel to perform unintended resets of guest hardware queues due to interpreting uninitialized stack data as valid identifiers. This may affect the stability or operation of guest virtual machines relying on the vfio-ap driver on s390 architectures. There is no indication of known exploitation in the wild.

Summary

CVE-2026-93238 addresses a flaw in the Linux kernel's s390 vfio-ap component where the apm_filtered bitmap is declared on the stack without zero-initialization. Under certain conditions, specifically when only control domains are added during hot plug configuration changes, the initialization function for apm_filtered is bypassed. As a result, uninitialized stack data may be interpreted as valid APIDs in reset_queues_for_apids(), causing unintended resets of guest hardware queues. The fix involves explicitly zero-initializing the apm_filtered bitmap at the beginning of vfio_ap_mdev_hot_plug_cfg() using bitmap_zero().

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:59 UTC

Technical details

References

Community reviews

Related threats