CVE-2026-98476s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid_to_chp() can return NULL, leading to a NULL pointer dereference. Add the missing NULL check before dereferencing the returned pointer.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | 199652309a4d6635fca19d7528d73ab9e219bd9a builds before 9d8b21820caed9128945fffcedf03e2a4c21eee2; 199652309a4d6635fca19d7528d73ab9e219bd9a builds before 5fc54e04dad90b15d0430118b3f288a1d64e66c9; 199652309a4d6635fca19d7528d73ab9e219bd9a builds before 27e396a89f76f742abdbe9f8c4a58a6e806fdf59; from 199652309a4d6635fca19d7528d73ab9e219bd9a before dbf30e661ceb9a52c94c85719716391dcc29142a; 199652309a4d6635fca19d7528d73ab9e219bd9a builds before 5e006ac90a4d331db1dd712b91fec849b45ffc01; from 199652309a4d6635fca19d7528d73ab9e219bd9a before c3bbcb32deecc06ebb1762398399b566d5ff2fc9; 199652309a4d6635fca19d7528d73ab9e219bd9a builds before 44b16b02608058fc72198ac0205969f0f43065df; 199652309a4d6635fca19d7528d73ab9e219bd9a builds before 5b76268dac968612f7283d59b539036de955b7d9 | CNA record |
References
- https://git.kernel.org/stable/c/9d8b21820caed9128945fffcedf03e2a4c21eee2
- https://git.kernel.org/stable/c/5fc54e04dad90b15d0430118b3f288a1d64e66c9
- https://git.kernel.org/stable/c/27e396a89f76f742abdbe9f8c4a58a6e806fdf59
- https://git.kernel.org/stable/c/dbf30e661ceb9a52c94c85719716391dcc29142a
- https://git.kernel.org/stable/c/5e006ac90a4d331db1dd712b91fec849b45ffc01
- https://git.kernel.org/stable/c/c3bbcb32deecc06ebb1762398399b566d5ff2fc9
- https://git.kernel.org/stable/c/44b16b02608058fc72198ac0205969f0f43065df
- https://git.kernel.org/stable/c/5b76268dac968612f7283d59b539036de955b7d9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.