Cloudanix VulnDB

CVE-2026-98476

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing safety check in low-level hardware handling code can cause the system to crash unexpectedly on certain IBM mainframe servers.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in ccw_device_get_util_str() when chpid_to_chp() returns NULL because a channel path registry entry was removed while the subchannel PMCW still references the CHPID.

Why it matters to the business

Kernel panic or crash on affected s390 systems resulting in unexpected downtime and loss of availability for workloads running on those platforms.

How an attack unfolds

An attacker with local access triggers concurrent removal of a channel path entry while code paths still hold references through the subchannel PMCW, causing the missing NULL check to dereference an invalid pointer and crash the kernel.

How to fix it

Apply the upstream fix that adds the missing NULL check before dereferencing the pointer returned by chpid_to_chp(); update to a kernel containing the resolution in s390/cio.

How to confirm the fix worked

Inspect the ccw_device_get_util_str() implementation for the added NULL check on the chpid_to_chp() result; verify the running kernel version includes the commit that resolved the race.

Typical attack path

  1. Obtain local code execution on an s390 Linux system
  2. Manipulate channel path or subchannel state to remove a registry entry while PMCW references remain
  3. Invoke ccw_device_get_util_str() or a caller that reaches the unchecked chpid_to_chp() result
  4. Trigger NULL dereference leading to kernel panic

How to detect it

Search kernel logs for oops/panic traces containing ccw_device_get_util_str, chpid_to_chp, or NULL pointer dereference in the s390 cio subsystem; correlate with subchannel or CHPID configuration changes.

What your security team should do

  • Patch s390 Linux kernels to the fixed version as soon as available
  • Monitor for kernel oops or panic logs referencing ccw_device_get_util_str or chpid_to_chp
  • Restrict local unprivileged access on s390 systems until patched

The record

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid_to_chp() can return NULL, leading to a NULL pointer dereference. Add the missing NULL check before dereferencing the returned pointer.

Affected packages

Ecosystem Package Introduced Fixed