CVE-2026-53116: Linux Kernel s390 AP Bus Use-After-Free Vulnerability

Technical summary

CVE-2026-53116 is a use-after-free (CWE-416) vulnerability in the s390/ap subsystem of the Linux kernel. The vulnerability arises when ap_bus_revise_bindings() is invoked after releasing ap_attr_mutex during AP mask updates (via apmask_store() or aqmask_store()). The function __ap_revise_reserved() then accesses the driver_override field without synchronization, creating a race condition against concurrent driver_override_store() calls that may free the underlying string. The kernel's generic driver_override infrastructure provides internal spinlock protection; adoption of this mechanism eliminates the unprotected access pattern. The AP bus deviates from standard implementations by checking driver_override in ap_device_probe() and __ap_revise_reserved() rather than in the match() callback, and maintains custom sysfs semantics and reference counting that must be preserved in the fix.

Business impact

This vulnerability primarily affects s390 (IBM System z) systems running vulnerable Linux kernels. While exploitation requires local access and specific race condition timing, successful exploitation could lead to kernel panic (denial of service) or, under certain conditions, code execution with kernel privileges. Organizations operating IBM mainframe infrastructure—particularly those using Linux on z Systems for security services, compliance workloads, or containerized applications—should prioritize patching. The HIGH CVSS score (7.8) reflects the severity of kernel-level memory corruption, though real-world exploitation likelihood is moderated by local-only access requirements and race condition constraints.

Affected systems

The vulnerability affects the Linux kernel on s390 architecture platforms (IBM System z mainframes). Only systems with AP (Adjunct Processor) devices configured and using affected kernel versions are at risk. This is primarily relevant to IBM mainframe operators. Systems on other architectures (x86_64, ARM, etc.) are not affected.

Exploitability

Exploitation requires local system access and the ability to trigger concurrent updates to AP driver overrides while simultaneously modifying AP security masks. The attack must win a race condition between two unprotected code paths, making reliable exploitation difficult but not impossible. No public exploit code or in-the-wild attacks are documented. The vulnerability is not classified as active exploitation (not in CISA KEV catalog).

Remediation

Update the Linux kernel to a patched version. Verify the specific stable kernel release for your distribution that includes the fix for CVE-2026-53116; this typically involves migrating to a kernel version released on or after the patch merge. For s390-specific deployments, coordinate with your distribution (Red Hat, SUSE, IBM) for validated patch availability, as mainframe kernel updates often require additional testing and change management.

Patch guidance

Identify your current kernel version and distribution. Check your vendor's security advisory or errata system (Red Hat Security Updates, SUSE Security Announcements, etc.) for the patched kernel version corresponding to CVE-2026-53116. Test the patched kernel in a non-production environment to ensure compatibility with your AP device configuration and workloads. Schedule a maintenance window for kernel update and reboot, as the fix requires a kernel restart. Verify the update by confirming the new kernel version at boot and checking dmesg for any AP subsystem warnings.

Detection guidance

Detection of exploitation attempts is challenging, as successful exploitation would manifest as unexpected kernel oops messages related to AP driver code or memory corruption. Monitor system logs for panic messages referencing ap_device_probe(), __ap_revise_reserved(), or driver_override code paths. Observe for unscheduled kernel crashes or hangs on systems with AP devices. Enable kernel debugging or audit logging if your operational posture permits, focusing on sysfs writes to apmask, aqmask, and driver_override attributes. Baseline normal AP driver behavior on your fleet to identify anomalies.

Why prioritize this

Prioritize this vulnerability for s390/mainframe environments. The HIGH CVSS score (7.8) and kernel-level impact warrant timely patching. However, if your organization does not operate IBM System z infrastructure, this has lower priority. For affected environments, the combination of local-access requirement and race condition difficulty slightly reduces practical urgency compared to network-exploitable kernel flaws, but the severity of kernel memory corruption justifies expedited scheduling within your change management process.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (LAN/console access required), Attack Complexity Low (race condition is straightforward once triggered), Privileges Required Low (standard user can trigger AP mask updates on certain systems), User Interaction None, and Confidentiality/Integrity/Availability all High (kernel-level UAF can leak memory, corrupt state, or crash the system). The score appropriately captures kernel vulnerability severity while the local-only attack vector prevents a CRITICAL rating. The absence of KEV status indicates no evidence of active exploitation, reducing practical risk slightly but not reducing the intrinsic severity.

Frequently asked questions