CVE-2026-97980

A flaw was found in the Linux kernel's s390 architecture debug component. A missing validation check in the debug level configuration interface allows an uninitialized or invalid debug handle to be dereferenced. A local user could exploit this flaw to crash the system, resulting in a Denial of Service (DoS).

A low impact NULL pointer dereference flaw was found in the Linux kernel s390 architecture debug component. Upstream commit a2cec6863709 ("s390/debug: Add s390dbf kernel parameter") incorrectly removed a null-id check from debug_set_level(), so a kernel debug-API user that passes an unchecked debug_register() result into debug_set_level() can trigger a NULL pointer dereference, resulting in a kernel oops and a local denial of service. Triggering the flaw requires an s390 system, a debug registration failure (for example under memory pressure), and an in-kernel debug-API caller that does not validate the debug_register() result, so it is only reachable under exceptional conditions and only availability is affected.

The kernel and kernel-rt packages in the currently supported Red Hat Enterprise Linux streams, the Red Hat In-Vehicle OS kernels, and the RHCOS kernels shipped with OpenShift Container Platform are marked not affected because the vulnerable code, introduced upstream in the 7.2 kernel development cycle, is not present in those shipped kernels. The Linux kernel as shipped with Red Hat Enterprise Linux 6 Extended Life Support is out of support scope. Although the CVSS:3.1 base score of 5.5 corresponds to moderate severity, the practical impact is low because the flaw can only be triggered under the exceptional conditions described above and its only consequence is a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.