Live › vulnerability › CVE-2026-98474
Go to dashboardThe Linux kernel's s390 PCI code reads a device's driver pointer in zpci_report_status() without holding the device lock, so the state can be inconsistent during recovery. The sources do not state what an attacker gains from this race.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only IBM Z (s390) systems with PCI devices appear to be involved, since the code path is s390-specific. The sources do not describe a remote trigger, so exposure beyond s390 hosts is unknown.
No product ranges from the sources yet.
uname -r to see the running kernel versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
s390/pci: Fix missing device lock in zpci_report_status()
When pdev is non-NULL, zpci_report_status() accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the existing device lock critical section.
The lock only needs to be held when the pdev is non-NULL, so extract the pdev-specific reporting into a helper function which also adds a lockdep assertion to detect calls without the device lock held.
This page as .md · .json · in your agent: get_signal("CVE-2026-98474")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.