CVE-2026-98476

A flaw was found in the Linux kernel's s390 channel I/O (CIO) subsystem. When querying device utility strings, the kernel fails to verify that an associated channel path remains valid after its removal from the registry. A local user could exploit this condition during hardware reconfiguration, resulting in a NULL pointer dereference that causes a system crash and Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact because it is restricted to systems running on the IBM Z (s390x) architecture and only results in a local denial of service. Exploitation requires specific timing during dynamic channel path reconfiguration and concurrent device queries, presenting high complexity and preventing code execution or unauthorized data exposure. Systems operating on non-s390x hardware architectures are not vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.