The Linux kernel s390 AP bus driver had a race condition leading to a use-after-free vulnerability. Specifically, when AP masks are updated via apmask_store() or aqmask_store(), ap_bus_revise_bindings() calls __ap_revise_reserved() after releasing ap_attr_mutex. __ap_revise_reserved() accesses the driver_override field without holding a lock, racing against driver_override_store() which may free the old string, causing a potential use-after-free. The vulnerability was fixed by switching to the generic driver_override infrastructure that uses an internal spinlock to protect all accesses. The AP bus differs from other buses by checking driver_override in ap_device_probe() and __ap_revise_reserved(), and it uses a custom counter in driver_override_store().

This vulnerability could lead to use-after-free conditions in the kernel, potentially causing system instability or crashes. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions running on s390 architecture with the AP bus driver. There is no indication of privilege escalation or remote exploitation from the provided data.

A fix is available in linux-hwe-edge kernel versions 7.0.0-28.28.1 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Since this is not a cloud service, manual patching is required. No additional mitigation steps are indicated by the vendor advisory.