{"id":"CVE-2026-98474","kind":"vulnerability","aliases":["CVE-2026-98474"],"related":[],"title":"Linux kernel s390 PCI: missing device lock in zpci_report_status","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Fix missing device lock in zpci_report_status()\n\nWhen pdev is non-NULL, zpci_report_status() accesses the device's driver.\nTo get a consistent state matching the recovery, the device lock needs to\nbe held. Do so by expanding the existing device lock critical section.\n\nThe lock only needs to be held when the pdev is non-NULL, so extract\nthe pdev-specific reporting into a helper function which also adds a\nlockdep assertion to detect calls without the device lock held.","summary":"The Linux kernel's s390 PCI code reads a device's driver pointer in zpci_report_status() without holding the device lock, so the state can be inconsistent during recovery. The sources do not state what an attacker gains from this race.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-z","infrastructure","linux-kernel","s390"],"not_affected_if":["non-s390-architecture"],"how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the s390 PCI path is in use on a given system; the sources do not say","fix":"- Update the Linux kernel to a release that includes the upstream s390/pci fix for CVE-2026-98474; the fixed version numbers are unknown from the sources","status":"open","published_at":"2026-10-18T16:16:57+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:57+00:00","updated_at":"2026-10-25T05:25:57+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream s390/pci fix for CVE-2026-98474; the fixed version numbers are unknown from the sources","reach":"local","title":"Linux kernel s390 PCI: missing device lock in zpci_report_status","impact":"low","summary":"The Linux kernel's s390 PCI code reads a device's driver pointer in zpci_report_status() without holding the device lock, so the state can be inconsistent during recovery. The sources do not state what an attacker gains from this race.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","s390","ibm-z"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources only describe a locking race in kernel PCI code","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed version ranges and the security impact.","how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the s390 PCI path is in use on a given system; the sources do not say","needs_analyst":true,"not_affected_if":["non-s390-architecture"],"who_is_affected":"Only IBM Z (s390) systems with PCI devices appear to be involved, since the code path is s390-specific. The sources do not describe a remote trigger, so exposure beyond s390 hosts is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3394,"output_tokens":516,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98474':14A,17A 'access':96C 'add':153C 'also':152C 'assert':156C 'attack':63B 'call':159C 'code':32B 'consist':104C 'critic':124C 'cve':12A,15A 'detect':158C 'devic':6A,35B,46B,81C,98C,110C,122C,162C 'driver':37B,100C 'exist':121C 'expand':119C 'extract':141C 'fix':79C 'follow':73C 'function':150C 'gain':64B 'get':102C 'held':115C,132C,164C 'helper':149C 'hold':44B 'ibm':19B 'ibm-z':18B 'inconsist':53B 'infrastructur':21B 'kernel':2A,24B,28B,71C 'linux':1A,23B,27B,70C 'linux-kernel':22B 'lock':7A,47B,82C,111C,123C,127C,163C 'lockdep':155C 'match':106C 'miss':5A,80C 'need':112C,129C 'non':91C,138C 'non-nul':90C,137C 'null':92C,139C 'pci':4A,31B 'pdev':88C,135C,144C 'pdev-specif':143C 'pointer':38B 'race':67B 'read':33B 'recoveri':55B,108C 'report':10A,41B,85C,94C,146C 'resolv':77C 's390':3A,25B,30B 's390/pci':78C 'section':125C 'sourc':57B 'specif':145C 'state':50B,60B,105C 'status':11A,42B,86C,95C 'vulner':74C 'without':43B,160C 'z':20B 'zpci':9A,40B,84C,93C","nicknames":[],"mitigations":[],"who_affected":"Only IBM Z (s390) systems with PCI devices appear to be involved, since the code path is s390-specific. The sources do not describe a remote trigger, so exposure beyond s390 hosts is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98474","severity":null,"published_at":"2026-10-18T16:16:57+00:00","modified_at":"2026-10-19T10:18:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}