---
title: "CVE-2026-89795: CVE-2026-89795"
description: "In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI function granularity. This is also reflected in the s390 PCI hotplug driver which creates hotplug slots for individual PCI functions. Its reset_slot() function, which is a wrapper for zpci_hot_reset_device(), thus also resets individual functions. Currently, the pci_create_slot() assigns the same pci_slot object to multifunction devices. This approach worked fine on s390 systems that only exposed virtual functions as individual PCI domains to the operating system. Since commit 44510d6fa0c0 (\"s390/pci: Handling multifunctions\") s390 supports exposing the topology of multifunction PCI devices by grouping them in a shared PCI domain. This creates a problem when resetting a function through the hotplug driver's slot_reset() interface. When attempting to reset a function through the hotplug driver, the shared slot assignment causes the wrong function to be reset instead of the intended one. It also leaks memory as we do create a pci_slot object for the function, but don't correctly free it in pci_slot_release(). Add a flag for struct pci_slot to allow per function PCI slots for functions managed through a hypervisor, which exposes individual PCI functions while retaining the topology. Since we can use all 8 bits for slot 'number' (for ARI devices), change slot 'number' u16 to account for special values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES."
url: https://panop.io/threat-heartbeat/CVE-2026-89795/
---

# CVE-2026-89795 CVE-2026-89795

In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI function granularity. This is also reflected in the s390 PCI hotplug driver which creates hotplug slots for individual PCI functions. Its reset\_slot() function, which is a wrapper for zpci\_hot\_reset\_device(), thus also resets individual functions. Currently, the pci\_create\_slot() assigns the same pci\_slot object to multifunction devices. This approach worked fine on s390 systems that only exposed virtual functions as individual PCI domains to the operating system. Since commit 44510d6fa0c0 ("s390/pci: Handling multifunctions") s390 supports exposing the topology of multifunction PCI devices by grouping them in a shared PCI domain. This creates a problem when resetting a function through the hotplug driver's slot\_reset() interface. When attempting to reset a function through the hotplug driver, the shared slot assignment causes the wrong function to be reset instead of the intended one. It also leaks memory as we do create a pci\_slot object for the function, but don't correctly free it in pci\_slot\_release(). Add a flag for struct pci\_slot to allow per function PCI slots for functions managed through a hypervisor, which exposes individual PCI functions while retaining the topology. Since we can use all 8 bits for slot 'number' (for ARI devices), change slot 'number' u16 to account for special values PCI\_SLOT\_PLACEHOLDER and PCI\_SLOT\_ALL\_DEVICES.

CVSS base score 8.4 /10

High

CISA KEV

Not listed

Public exploit

None known

EPSS

0.17% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89795)

## Details

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Published

16 September 2026

Updated

15 October 2026

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89795](https://nvd.nist.gov/vuln/detail/CVE-2026-89795)
- [https://git.kernel.org/stable/c/2050d900f9adbd6d6f38d30e182bcd9ad3108467](https://git.kernel.org/stable/c/2050d900f9adbd6d6f38d30e182bcd9ad3108467)
- [https://git.kernel.org/stable/c/dcc5bec09e23bbc4f9de055a11fce9937244f2c8](https://git.kernel.org/stable/c/dcc5bec09e23bbc4f9de055a11fce9937244f2c8)
- [https://git.kernel.org/stable/c/ecdcceed4d377b02d4ea036b65f83f962c38ede7](https://git.kernel.org/stable/c/ecdcceed4d377b02d4ea036b65f83f962c38ede7)
- [https://git.kernel.org/stable/c/0d1a7d67f45645106578d65181e4e492dd20ed79](https://git.kernel.org/stable/c/0d1a7d67f45645106578d65181e4e492dd20ed79)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)