PCI: Allow per function PCI slots to fix slot reset on s390 (Linux Linux)

CVE-2026-89795
HIGH 8.4

At a glance

Source
NVD
EPSS
EPSS 0.17 % · percentile 6 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI function granularity. This is also reflected in the s390 PCI hotplug driver which creates hotplug slots for individual PCI functions. Its reset_slot() function, which is a wrapper for zpci_hot_reset_device(), thus also resets individual functions. Currently, the pci_create_slot() assigns the same pci_slot object to multifunction devices. This approach worked fine on s390 systems that only exposed virtual functions as individual PCI domains to the operating system. Since commit 44510d6fa0c0 ("s390/pci: Handling multifunctions") s390 supports exposing the topology of multifunction PCI devices by grouping them in a shared PCI domain. This creates a problem when resetting a function through the hotplug driver's slot_reset() interface. When attempting to reset a function through the hotplug driver, the shared slot assignment causes the wrong function to be reset instead of the intended one. It also leaks memory as we do create a pci_slot object for the function, but don't correctly free it in pci_slot_release(). Add a flag for struct pci_slot to allow per function PCI slots for functions managed through a hypervisor, which exposes individual PCI functions while retaining the topology. Since we can use all 8 bits for slot 'number' (for ARI devices), change slot 'number' u16 to account for special values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES.

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:HLinux
CVSS 3.1HIGH 8.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected 44510d6fa0c00aa90b80075caa6b313b25927475 < afdd497ca3836eda13530ab75b416d52f6d6129a ; affected 44510d6fa0c00aa90b80075caa6b313b25927475 < b4a80e9e639cf09ef5c66b7f262c9cb5ab37bdde ; affected 44510d6fa0c00aa90b80075caa6b313b25927475 < 0d1a7d67f45645106578d65181e4e492dd20ed79 ; affected 44510d6fa0c00aa90b80075caa6b313b25927475 < 2050d900f9adbd6d6f38d30e182bcd9ad3108467 ; affected 44510d6fa0c00aa90b80075caa6b313b25927475 < ecdcceed4d377b02d4ea036b65f83f962c38ede7 ; affected 44510d6fa0c00aa90b80075caa6b313b25927475 < dcc5bec09e23bbc4f9de055a11fce9937244f2c8
Linux · Linuxaffected 5.8 ; unaffected 0 < 5.8 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.112 ≤ 6.12.* ; unaffected 6.18.52 ≤ 6.18.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD