CVE-2026-80679: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80679 Overview

CVE-2026-80679 is a NULL pointer dereference vulnerability in the Linux kernel's s390/dasd driver. The flaw resides in the dasd_release_space() function, which incorrectly uses a logical AND operator when validating the is_ese() discipline function pointer. This coding error causes the kernel to invoke the function even when the function pointer is NULL, leading to a dereference of an invalid address. The issue affects s390 (IBM Z) systems using Direct Access Storage Devices (DASD), specifically Extent Space Efficient (ESE) DASD volumes. Successful triggering results in a kernel oops and potential denial of service on the affected system.

Critical Impact
A NULL pointer dereference in the s390 DASD driver can crash the Linux kernel on IBM Z systems, causing denial of service for storage-dependent workloads.

Affected Products

Linux kernel (upstream) — s390/dasd subsystem
IBM Z (s390x) Linux distributions shipping the affected DASD driver
Systems configured with Extent Space Efficient (ESE) DASD volumes

Discovery Timeline

2026-08-28 - CVE-2026-80679 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80679

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the dasd_release_space() function of the Linux kernel's s390/dasd driver. This driver manages IBM mainframe Direct Access Storage Devices, including thinly provisioned Extent Space Efficient (ESE) volumes.

Before performing ESE-specific release logic, the function must determine whether the target device belongs to a discipline that implements the is_ese() callback. The intended safety pattern is to first verify the function pointer is non-NULL, then invoke it. The current implementation combines these two operations with the wrong boolean operator.

As a result, the kernel can call is_ese() on disciplines that do not implement the callback. Dereferencing the NULL function pointer triggers a kernel oops on the s390 architecture, halting the caller and destabilizing storage operations for the affected device.

Root Cause

The root cause is an incorrect boolean operator in a guarded function-pointer call. The check uses a logical AND (&&) where a logical OR (||) is required to short-circuit correctly. Instead of skipping the call when the discipline lacks an is_ese() implementation, the flawed condition allows execution to reach the call site with a NULL pointer. The fix replaces the operator so the code path is bypassed when the callback is not implemented.

Attack Vector

Triggering the flaw requires operations against a DASD device whose discipline does not implement is_ese(), reaching the dasd_release_space() code path. This is a local, kernel-side condition rather than a remotely reachable attack surface. The practical impact is denial of service through a kernel crash. There is no indication of memory corruption, privilege escalation, or code execution associated with this defect, and no public exploit is available.

A synthetic exploit is not applicable. Refer to the upstream commits linked under external references for the exact source-level change.

Detection Methods for CVE-2026-80679

Indicators of Compromise

Kernel oops or panic messages referencing dasd_release_space in dmesg or /var/log/messages on s390x hosts.
Stack traces implicating the s390/dasd module during space-release operations on ESE volumes.
Unexpected I/O stalls or device offlining events for DASD devices immediately preceded by NULL pointer dereference warnings.

Detection Strategies

Inventory s390x Linux hosts and correlate running kernel versions against the fixed commits listed in the kernel.org references.
Monitor kernel log streams for BUG: kernel NULL pointer dereference events tied to the DASD subsystem.
Use configuration management tooling to flag hosts running unpatched kernels that expose the dasd module with ESE devices attached.

Monitoring Recommendations

Forward kernel logs from IBM Z Linux guests to a centralized logging or SIEM platform for continuous review.
Alert on repeated DASD driver faults, which may indicate exercise of the vulnerable code path.
Track storage subsystem availability metrics for anomalies coinciding with kernel fault events.

How to Mitigate CVE-2026-80679

Immediate Actions Required

Identify all s390x systems running Linux kernels that include the vulnerable dasd_release_space() logic.
Apply the upstream stable kernel updates that replace the logical AND with a logical OR in the guarded call.
Coordinate with your Linux distribution vendor to obtain backported packages for supported enterprise kernels.

Patch Information

The fix has been merged across multiple stable branches. Reference commits include Kernel Commit 3000367, Kernel Commit 3453a99, Kernel Commit 86cdfd0, Kernel Commit 96b8e09, Kernel Commit 9973026, Kernel Commit cdc7b73, Kernel Commit dbf2ae3, and Kernel Commit e156c70. Deploy the version provided by your distribution once available.

Workarounds

Restrict administrative operations that trigger space-release actions on ESE DASD volumes until the kernel is patched.
Limit local shell access on affected s390x hosts to trusted operators to reduce the chance of accidental triggering.
Where feasible, schedule maintenance windows to reboot into patched kernels rather than relying on runtime workarounds.

bash

# Verify the running kernel version on an s390x host and check module status
uname -r
lsmod | grep dasd
# After installing the vendor-provided kernel update, reboot to activate the fix
sudo reboot