CVE-2026-45981 s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
A use-after-free vulnerability in the Linux kernel s390 channel I/O subsystem allows attackers to potentially execute code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45981?
CVE-2026-45981 is a medium-severity use after free vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
`css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting.
Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure.
Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly.
This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues.
Weakness: CWE-401
Which versions are affected by CVE-2026-45981?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45981?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-45981 being exploited?
There is no known exploitation of CVE-2026-45981 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-45981, DEBIAN-CVE-2026-45981, GHSA-w3x6-6f6f-54f3, ROOT-OS-DEBIAN-11-CVE-2026-45981, ROOT-OS-UBUNTU-2204-CVE-2026-45981, ROOT-OS-UBUNTU-2404-CVE-2026-45981 and 1 more.