Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93238— s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： s390/vfio-ap：修复可能使用未初始化的 apm_filtered 位图的问题 宏在栈上分配位图，但未进行零初始化。 在 函数中，仅当 或 为真时，才会调用 函数来初始化并填充 。如果热插拔配置变更仅添加了控制域（即 为真，但 和 均为假），则会绕过 调用。 因此， 会以未初始化的栈垃圾数据传递给 。这可能导致 将任意栈垃圾数据中的位解释为有效的 APID（适配器处理器标识符）并进行重置，从而可能意外地执行对来宾客户机硬件队列的重置操作。 通过在 函数开头使用 将

AI Predicted 5.3 Difficulty: Easy EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux eeb386aeb5b7c8d2dae6a3ba49255d8a97803182< 4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2 affected
eeb386aeb5b7c8d2dae6a3ba49255d8a97803182< f73db632524320d2b93bc8534be8ea875053502d affected
eeb386aeb5b7c8d2dae6a3ba49255d8a97803182< 6d554f2571e6b4db242593ba561efd6a6d1f99a9 affected
eeb386aeb5b7c8d2dae6a3ba49255d8a97803182< 09548edc6114f1eb1035b30795e893204ef45b85 affected
eeb386aeb5b7c8d2dae6a3ba49255d8a97803182< bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7 affected
6.0 affected
< 6.0 unaffected
6.6.157≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93238

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap The DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap on the stack without zero-initializing it. In vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function is only called to initialize and populate apm_filtered if either filter_adapters or filter_domains is true. If the hot plug configuration change only adds control domains (meaning filter_cdoms is true, but filter_adapters and filter_domains are both false), vfio_ap_mdev_filter_matrix() is bypassed. Consequently, apm_filtered is passed to reset_queues_for_apids() with uninitialized stack garbage. This can cause reset_queues_for_apids() to interpret arbitrary stack garbage bits as valid APIDs to reset, potentially performing unintended guest hardware queue resets. Fix this by zero-initializing the apm_filtered bitmap at the beginning of vfio_ap_mdev_hot_plug_cfg() using bitmap_zero().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux eeb386aeb5b7c8d2dae6a3ba49255d8a97803182 ~ 4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2 -
Linux Linux 6.0 -

II. Public POCs for CVE-2026-93238

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93238

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93238 (5)

Same Patch Batch · Linux · 2026-09-24 · 234 CVEs total

CVE-2026-93207 9.8 CRITICAL SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
CVE-2026-97413 9.8 CRITICAL RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
CVE-2026-93228 9.1 CRITICAL svcrdma: Reject Write/Reply chunks with segcount 0
CVE-2026-93793 8.8 HIGH wifi: iwlwifi: mvm: validate TX_CMD response layout
CVE-2026-93799 8.8 HIGH wifi: iwlwifi: mvm: validate sta_id in BA window status notif
CVE-2026-93790 8.8 HIGH wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
CVE-2026-93806 8.8 HIGH wifi: cfg80211: validate assoc response length before status and IE access
CVE-2026-97442 8.8 HIGH wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
CVE-2026-97509 8.8 HIGH thunderbolt: Keep XDomain reference during the lifetime of a service
CVE-2026-97409 8.8 HIGH nvme-fc: Do not cancel requests in io target before it is initialized
CVE-2026-93280 8.8 HIGH greybus: audio: bound the topology section sizes against the fetched size
CVE-2026-93284 8.8 HIGH drm/pagemap: dma-unmap pages before handling migration errors
CVE-2026-97451 8.4 HIGH ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
CVE-2026-97452 8.4 HIGH ACPICA: Prevent adding invalid references
CVE-2026-97455 8.4 HIGH ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
CVE-2026-97450 8.4 HIGH ACPICA: validate handler object type in two places
CVE-2026-93827 8.4 HIGH virtio-fs: avoid double-free on failed queue setup
CVE-2026-97433 8.2 HIGH nvme: validate FDP configuration descriptor sizes
CVE-2026-93221 8.1 HIGH nfsd: convert nfsd_net boolean flags to unsigned long flags word
CVE-2026-93786 8.1 HIGH ksmbd: preserve VFS inherited POSIX ACL mask

Showing top 20 of 234 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-93238

No comments yet

Leave a comment