Executive brief
A vulnerability was identified in the Linux kernel's s390 architecture subsystem. It involves improper management of hardware device lifecycles during initialization. If a specific hardware setup step fails, the system might incorrectly free memory, potentially leading to system instability or crashes. This affects the reliability of IBM Z (s390) systems running Linux.
Technical details
A vulnerability in `drivers/s390/cio/css.c` within the Linux kernel's s390 architecture support arises from incorrect reference counting in `css_alloc_subchannel()`. The function calls `device_initialize()`, which initializes the reference counter for the embedded `struct device`. However, if subsequent calls to `dma_set_coherent_mask()` or `dma_set_mask()` fail, the error path invokes `kfree()` directly on the subchannel structure. This bypasses the device model's reference counting mechanism. To exploit this, an attacker would likely need to trigger specific hardware initialization failures. The fix replaces the direct `kfree()` call with `put_device()`, ensuring the release callback handles memory deallocation correctly. This prevents potential use-after-free or double-free scenarios.
Affected products
- Linux Linux Kernel s390/cio component
Timeline
- 2026-05-27: disclosed: CVE published by kernel.org via NVD
- 2026-03-04: patched: Fix committed to stable kernel branches
References
- https://git.kernel.org/stable/c/2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681
- https://git.kernel.org/stable/c/6715560527e343a387e4a0d2e6c401748e89fa55
- https://git.kernel.org/stable/c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42
- https://git.kernel.org/stable/c/b1d4e6fb241672850296956c4d782a69363a3807
- https://git.kernel.org/stable/c/c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603
- https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7
- https://git.kernel.org/stable/c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424