CVE-2026-97593 iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
A missing NULL check in the s390 IOMMU driver allows local attackers to cause a kernel crash via a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97593?
CVE-2026-97593 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX get_rso_from_iova() returns NULL when the region-first entry is invalid. Yet in get_rto_from_iova() the region-second origin rso is not checked to be non-NULL before accessing rso[rsx] leading to a NULL pointer dereference instead of a NULL return when iova_to_phys() is called on a unmapped IOVA. Fix this by adding the missing NULL check.
Which versions are affected by CVE-2026-97593?
How do I fix CVE-2026-97593?
Apply the vendor's patch.
Is CVE-2026-97593 being exploited?
There is no known exploitation of CVE-2026-97593 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97593, DEBIAN-CVE-2026-97593, GHSA-grwc-9m6f-f7hf, UBUNTU-CVE-2026-97593.