{"id":"CVE-2026-98476","kind":"vulnerability","aliases":["CVE-2026-98476"],"related":[],"title":"Linux kernel s390 channel I/O: NULL pointer dereference crashes the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()\n\nThe channel path registry entry associated with a CHPID may be removed\nwhile the subchannel's PMCW still references that CHPID. In this case,\nchpid_to_chp() can return NULL, leading to a NULL pointer dereference.\n\nAdd the missing NULL check before dereferencing the returned pointer.","summary":"On IBM Z (s390) systems, a channel path entry can be removed while a subchannel still refers to it, and ccw_device_get_util_str() then dereferences a NULL pointer. The sources describe a kernel crash (NULL pointer dereference) and do not state any code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-z","infrastructure","linux-kernel","mainframe","s390"],"not_affected_if":["non-s390-architecture"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream fix adding the NULL check in ccw_device_get_util_str() (fixed version not named in the sources)","status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:57+00:00","updated_at":"2026-10-25T05:25:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix adding the NULL check in ccw_device_get_util_str() (fixed version not named in the sources)","reach":"local","title":"Linux kernel s390 channel I/O: NULL pointer dereference crashes the system","impact":"low","summary":"On IBM Z (s390) systems, a channel path entry can be removed while a subchannel still refers to it, and ccw_device_get_util_str() then dereferences a NULL pointer. The sources describe a kernel crash (NULL pointer dereference) and do not state any code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","s390","ibm-z","mainframe"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel NULL pointer dereference causes a crash or denial of service","analyst_note":"Find the upstream kernel commit and the first fixed stable versions for the s390 channel I/O fix, and confirm how the channel path removal is triggered.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["non-s390-architecture"],"who_is_affected":"Systems running the Linux kernel on IBM Z (s390) hardware with channel-path configuration changes, such as hot-plug or removal of channel paths. Systems on other architectures are not described as affected. The sources do not say how often the removal race occurs in practice.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000604,"input_tokens":3366,"output_tokens":534,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98476':14A,17A 'add':133C 'associ':102C 'case':120C 'ccw':47B,92C 'channel':4A,33B,98C 'check':137C 'chp':123C 'chpid':105C,117C,121C 'code':71B 'crash':9A,62B 'cve':12A,15A 'data':74B 'derefer':8A,53B,65B,90C,132C 'dereferenc':139C 'describ':59B 'devic':48B,93C 'entri':35B,101C 'execut':72B 'exposur':75B 'fix':87C 'follow':81C 'get':49B,94C 'i/o':5A 'ibm':19B,28B 'ibm-z':18B 'infrastructur':21B 'kernel':2A,24B,61B,79C 'lead':127C 'linux':1A,23B,78C 'linux-kernel':22B 'mainfram':25B 'may':106C 'miss':135C 'null':6A,55B,63B,88C,126C,130C,136C 'path':34B,99C 'pmcw':113C 'pointer':7A,56B,64B,89C,131C,142C 'refer':43B,115C 'registri':100C 'remov':38B,108C 'resolv':85C 'return':125C,141C 's390':3A,26B,30B 's390/cio':86C 'sourc':58B 'state':69B 'still':42B,114C 'str':51B,96C 'subchannel':41B,111C 'system':11A,31B 'util':50B,95C 'vulner':82C 'z':20B,29B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel on IBM Z (s390) hardware with channel-path configuration changes, such as hot-plug or removal of channel paths. Systems on other architectures are not described as affected. The sources do not say how often the removal race occurs in practice.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98476","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}