CVE-2026-98024s390/ism: folio_put() after error
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio_put() after error dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator corruption. While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF by future callers.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 121fb75414ab8debafd548bded9d888cd5a8f165 builds before 90f6f5cb331af52b14c0f309fb27dc243e8e2982; 83781384a96b95e2b6403d3c8a002b2c89031770 builds before 890e2ef726904d1d8328e4b9f5090eeb8761b9d1; from 83781384a96b95e2b6403d3c8a002b2c89031770 before eebb6a9017b55ac05be770cf7b89f9da49505ae7; 83781384a96b95e2b6403d3c8a002b2c89031770 builds before 60983356fab0c1171c5cb1b56a36349ebadc608e; 83781384a96b95e2b6403d3c8a002b2c89031770 builds before 907a56ab3eb8a58500a58daa76087f17bb2b6826; f3e23edc4917f72139b805f208aeadf23376a0b5; from 6.6.29 before 6.6.158; from 6.8.8 before 6.9 | CNA record |
References
- https://git.kernel.org/stable/c/90f6f5cb331af52b14c0f309fb27dc243e8e2982
- https://git.kernel.org/stable/c/890e2ef726904d1d8328e4b9f5090eeb8761b9d1
- https://git.kernel.org/stable/c/eebb6a9017b55ac05be770cf7b89f9da49505ae7
- https://git.kernel.org/stable/c/60983356fab0c1171c5cb1b56a36349ebadc608e
- https://git.kernel.org/stable/c/907a56ab3eb8a58500a58daa76087f17bb2b6826
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.