CVE-2026-98476 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
A local attacker can cause a denial of service in the Linux kernel s390 channel I/O subsystem via a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98476?
CVE-2026-98476 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid_to_chp() can return NULL, leading to a NULL pointer dereference.
Add the missing NULL check before dereferencing the returned pointer.
Which versions are affected by CVE-2026-98476?
How do I fix CVE-2026-98476?
Apply the vendor's patch.
Is CVE-2026-98476 being exploited?
There is no known exploitation of CVE-2026-98476 in the wild and no public exploit code.
Sources
Also known as AZL-108575, BELL-CVE-2026-98476, DEBIAN-CVE-2026-98476, GHSA-cfjv-hvgg-mwp9, UBUNTU-CVE-2026-98476.