CVE-2026-89457: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89457 Overview

CVE-2026-89457 is a NULL pointer dereference in the Linux kernel's s390/dasd driver. Several sysfs show and store handlers invoke a discipline callback that dereferences device->private, either directly or through the DASD_DEFINE_ATTR() macro. During dasd_generic_set_online(), the discipline is assigned before check_device() allocates device->private. An unprivileged read of one of the world-readable sysfs attributes in that window dereferences a NULL pointer and panics the kernel.

The upstream fix guards the dereference inside each callback that touches device->private.

Critical Impact
An unprivileged local user on an affected s390 system can trigger a kernel panic by reading world-readable sysfs attributes during device onlining, producing a denial-of-service condition.

Affected Products

Linux kernel s390/dasd Direct Access Storage Device driver
IBM Z (s390x) systems using DASD storage
Distributions shipping kernels prior to the fixes referenced in the upstream stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89457 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89457

Vulnerability Analysis

The issue is a classic NULL pointer dereference [CWE-476] triggered by a race between device onlining and sysfs attribute access. The dasd_generic_set_online() function assigns the discipline to the device before check_device() completes and allocates device->private. Between those two operations, discipline callbacks reachable through sysfs handlers assume device->private is a valid pointer.

Because the affected sysfs attributes are world-readable, any local user can cat them while a DASD device is being brought online. The resulting NULL dereference in kernel context produces an oops or panic on the s390 architecture, terminating the affected task or the system depending on kernel configuration.

Exploitation requires local access and the ability to time a read against a device state transition. There is no remote attack vector, no code execution, and no data disclosure — the impact is availability loss on IBM Z hosts running DASD storage.

Root Cause

The s390/dasd driver initializes the discipline pointer before the associated private structure is allocated. Sysfs show and store handlers, including those generated by the DASD_DEFINE_ATTR() macro, follow the discipline pointer into callbacks that unconditionally dereference device->private. When those callbacks execute during the initialization window, they read from a NULL pointer.

Attack Vector

A local, unprivileged user reads a world-readable sysfs attribute exposed by an initializing DASD device. Concurrent execution of dasd_generic_set_online() on the same device causes the discipline callback to dereference device->private before it is allocated. The read completes the race and triggers the kernel fault. No specific exploit code has been published; see the upstream kernel commits referenced below for the corrective patches.

Detection Methods for CVE-2026-89457

Indicators of Compromise

Kernel oops or panic entries in the system log referencing dasd, dasd_generic_set_online, or NULL pointer dereferences within DASD sysfs handlers.
Unexpected reboots or task terminations on IBM Z hosts coinciding with DASD device onlining events (chccwdev, dasd_configure).
Repeated reads of DASD sysfs attributes under /sys/bus/ccw/devices/* from non-root user contexts.

Detection Strategies

Monitor dmesg, journalctl -k, and kernel crash dumps for stack traces containing dasd_* symbols and BUG: unable to handle kernel NULL pointer dereference.
Correlate sysfs access telemetry with DASD device state transitions to surface race-condition attempts.
Track kernel version and patch level across s390x fleets and flag hosts running kernels that lack the referenced stable commits.

Monitoring Recommendations

Ingest kernel logs from all IBM Z hosts into a centralized log platform and alert on panics involving the dasd module.
Audit user-initiated reads of /sys/bus/ccw/devices/* attributes on production systems.
Baseline DASD device online and offline events and alert on anomalous concurrency.

How to Mitigate CVE-2026-89457

Immediate Actions Required

Inventory IBM Z systems and identify kernels that do not yet include the upstream s390/dasd fix commits listed in the references.
Apply the vendor kernel update from your Linux distribution once available and reboot affected hosts.
Restrict local shell access on s390x systems to trusted operators until patched kernels are deployed.

Patch Information

The fix guards each affected discipline callback against a NULL device->private pointer. Corrective patches are available in the mainline and stable trees via the following kernel commits: Kernel Commit 2a1780f9fc, Kernel Commit 449f3bada7, Kernel Commit 4a042d8e5f, Kernel Commit 536407b272, Kernel Commit 57db27ccc1, Kernel Commit 644b666c20, Kernel Commit 6452c13646, and Kernel Commit bd8b457252.

Workarounds

Limit interactive local access on IBM Z hosts and enforce least-privilege shell policies until patched kernels are deployed.
Serialize DASD device onlining operations so that sysfs attribute reads cannot overlap with dasd_generic_set_online().
Use monitoring agents rather than ad hoc user reads to sample DASD sysfs attributes during device state transitions.

bash

# Verify running kernel version and check for the s390/dasd fix
uname -r

# Review kernel log for NULL dereferences in dasd handlers
dmesg | grep -iE 'dasd|null pointer'

# Restrict user access to CCW sysfs attributes (example, adjust to policy)
find /sys/bus/ccw/devices -maxdepth 2 -type f -perm -o+r -name '*' \
  -exec chmod o-r {} \;