CVE-2026-89457

A flaw was found in the s390/dasd component of the Linux kernel. An unprivileged local user can trigger a null pointer dereference by reading specific world-readable sysfs attributes while the device is being brought online. This can lead to a kernel panic, resulting in a denial of service.

A MODERATE impact denial-of-service flaw was found in the Linux kernel s390/dasd driver. During dasd_generic_set_online() the discipline is assigned before check_device() allocates device->private, leaving a window in which several sysfs show/store handlers that call discipline callbacks dereferencing device->private operate on a NULL pointer. An unprivileged local user who reads one of the affected world-readable sysfs attributes during that window, while a DASD device is being brought online, can trigger a NULL pointer dereference that panics the kernel, resulting in a denial of service. Confidentiality and integrity are not affected. The kernel in Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 update streams, and in OpenShift Container Platform 4 RHCOS builds, is affected; Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. For the affected streams the fix is currently deferred: the flaw is rated MODERATE with a CVSSv3 score of 5.5 (below 7.0), which does not meet the bar for filing errata trackers, so no update is currently planned. The residual risk is limited to local denial of service: exploitation requires an unprivileged local account and a narrow timing window while a DASD device is being set online, with no privilege escalation, information disclosure, or data integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.