Live › vulnerability › CVE-2026-98476
Go to dashboardOn IBM Z (s390) systems, a channel path entry can be removed while a subchannel still refers to it, and ccw_device_get_util_str() then dereferences a NULL pointer. The sources describe a kernel crash (NULL pointer dereference) and do not state any code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel on IBM Z (s390) hardware with channel-path configuration changes, such as hot-plug or removal of channel paths. Systems on other architectures are not described as affected. The sources do not say how often the removal race occurs in practice.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid_to_chp() can return NULL, leading to a NULL pointer dereference.
Add the missing NULL check before dereferencing the returned pointer.
This page as .md · .json · in your agent: get_signal("CVE-2026-98476")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.