CVE-2026-45981

A flaw was found in the Linux kernel, specifically within the s390/cio component. This vulnerability stems from incorrect device lifecycle management during subchannel allocation. This could allow an attacker to trigger use-after-free or double-free conditions, potentially leading to system instability or a denial of service (DoS), which disrupts normal operations.

This vulnerability is evaluated as Moderate severity because it requires local authenticated access, only impacts deployments on IBM Z (s390x) hardware, and is limited in blast radius to a localized denial of service rather than arbitrary code execution. The condition arises only when device initialization encounters memory setup errors during subchannel configuration. Non-s390x platforms do not build or execute this channel subsystem code and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.