CVE-2026-98476: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98476 Overview

CVE-2026-98476 is a NULL pointer dereference vulnerability in the Linux kernel's s390 Channel I/O (CIO) subsystem. The flaw resides in the ccw_device_get_util_str() function within the s390/cio driver. A race condition allows the channel path registry entry associated with a Channel Path Identifier (CHPID) to be removed while the subchannel's Path Management Control Word (PMCW) still references that CHPID. When chpid_to_chp() returns NULL under this condition, the kernel dereferences the NULL pointer, triggering a crash on IBM Z (s390x) systems.

Critical Impact
An unchecked NULL return from chpid_to_chp() can cause a kernel oops and denial of service on affected s390 mainframe systems running vulnerable Linux kernels.

Affected Products

Linux kernel (s390/cio subsystem) on IBM Z architecture
Multiple stable kernel branches referenced across eight upstream commits
Distributions shipping unpatched Linux kernels for s390x

Discovery Timeline

2026-10-18 - CVE-2026-98476 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98476

Vulnerability Analysis

The vulnerability affects the s390 Common I/O Layer, which manages channel subsystem communications on IBM Z mainframes. The ccw_device_get_util_str() function retrieves utility string information for a Channel Command Word (CCW) device. During this lookup, it calls chpid_to_chp() to resolve a CHPID to its corresponding channel path structure.

The channel path registry entry can be removed asynchronously while the subchannel's PMCW still holds a reference to that CHPID. When this ordering occurs, chpid_to_chp() returns NULL. The original code dereferenced the returned pointer without validating it, causing a NULL pointer dereference [CWE-476] in kernel context.

The fix adds the missing NULL check before any dereference of the returned channel path pointer, preventing the kernel from accessing an invalid memory address.

Root Cause

The root cause is a missing NULL return value check in ccw_device_get_util_str(). The function assumed chpid_to_chp() would always return a valid pointer, but the channel path lifecycle is not synchronized with PMCW CHPID references. Removal of the channel path registry entry can occur between the PMCW reference being read and the channel path being accessed.

Attack Vector

Triggering this condition requires local interaction with the channel subsystem on s390 hardware. The race window opens during channel path removal or reconfiguration events. An unprivileged workload that reads device utility strings concurrently with channel path removal can induce the NULL dereference, resulting in a kernel crash and system-wide denial of service.

The vulnerability is specific to s390 architecture and does not affect x86, ARM, or other platforms. No synthetic exploit code is published; refer to the upstream patch commits for the exact code paths.

Detection Methods for CVE-2026-98476

Indicators of Compromise

Kernel oops messages referencing ccw_device_get_util_str or chpid_to_chp in dmesg or /var/log/messages
Unexpected kernel panics on IBM Z systems during channel path reconfiguration events
System reboots coinciding with hardware management console (HMC) CHPID vary off/on operations

Detection Strategies

Audit running kernel versions on all s390x hosts using uname -r and compare against patched builds from your distribution
Monitor kernel ring buffer logs for NULL pointer dereference stack traces originating in the drivers/s390/cio/ code paths
Correlate kernel crash events with channel subsystem configuration changes recorded by the HMC or Support Element

Monitoring Recommendations

Forward kernel logs from s390 Linux guests to a centralized logging platform for crash signature analysis
Alert on kernel BUG, Unable to handle kernel NULL pointer dereference, or Oops entries containing s390/cio symbols
Track channel path state transitions in environments running z/VM, KVM on Z, or LPAR Linux instances

How to Mitigate CVE-2026-98476

Immediate Actions Required

Inventory all IBM Z Linux systems and identify kernels missing the s390/cio NULL check fix
Apply vendor-supplied kernel updates from Red Hat, SUSE, Ubuntu, or Debian for the s390x architecture as they become available
Schedule maintenance windows to reboot affected systems into patched kernels
Minimize concurrent channel path reconfiguration activity on unpatched systems until updates are deployed

Patch Information

The fix adds the missing NULL check in ccw_device_get_util_str() before dereferencing the pointer returned by chpid_to_chp(). The upstream patch is distributed across multiple stable branches. Reference commits include Kernel Git Commit 27e396a, Kernel Git Commit 44b16b, Kernel Git Commit 5b7626, Kernel Git Commit 5e006a, Kernel Git Commit 5fc54e, Kernel Git Commit 9d8b21, Kernel Git Commit c3bbcb, and Kernel Git Commit dbf30e.

Workarounds

Avoid dynamic CHPID removal and reconfiguration operations on affected systems until a patched kernel is installed
Restrict local access on s390 Linux hosts to reduce the likelihood of triggering concurrent channel subsystem operations
Where possible, pin workloads to kernel builds that include the upstream s390/cio NULL check fix

bash

# Verify running kernel version on s390x hosts
uname -r

# Check for s390/cio related kernel messages
dmesg | grep -iE 'ccw_device_get_util_str|chpid_to_chp|cio'

# Example: update kernel on Red Hat Enterprise Linux for s390x
sudo dnf update kernel && sudo systemctl reboot