CVE-2026-80679

What it actually does

A NULL pointer dereference occurs in dasd_release_space() because the is_ese() function pointer is invoked regardless of whether it is NULL due to use of the logical AND operator instead of OR.

Why it matters to the business

May cause kernel crashes or denial of service on IBM Z mainframe systems using DASD storage, potentially affecting availability of critical workloads.

How an attack unfolds

An attacker with local access could trigger the vulnerable code path in dasd_release_space by manipulating DASD device operations to reach a state where the discipline function pointer is NULL, leading to dereference and crash.

How to fix it

Apply the upstream kernel fix that replaces the logical AND with OR when checking the is_ese() discipline function pointer before invocation in dasd_release_space().

How to confirm the fix worked

Inspect the dasd_release_space() implementation to confirm the check uses logical OR; perform functional testing of DASD release-space operations on devices with varying discipline pointers.

Typical attack path

1. Obtain local access on an affected s390 Linux system
2. Trigger DASD device operations that invoke dasd_release_space()
3. Ensure conditions where the discipline function pointer is NULL
4. Cause NULL pointer dereference resulting in kernel instability or panic

How to detect it

Search kernel logs and crash dumps for references to dasd_release_space and NULL pointer dereference errors on s390 platforms.

What your security team should do

• Update Linux kernel on s390 systems to the version containing the dasd fix
• Review kernel logs for oops or NULL dereference messages involving dasd code
• Restrict untrusted local access on systems using ESE DASD devices