Executive brief
The Linux kernel's s390 DASD disk driver contains a NULL pointer dereference vulnerability in the dasd_release_space() function. An attacker with local access to a system running affected kernel versions could trigger a kernel panic, causing a denial of service and system unavailability. This affects storage management operations on IBM System z architecture systems.
Technical details
The vulnerability is a logic error in the dasd_release_space() function within drivers/s390/block/dasd_ioctl.c. The function uses an incorrect logical AND operator when checking if the is_ese() discipline function pointer is NULL before calling it; it should use a logical OR operator instead. This causes the function to be invoked even when the pointer is NULL, resulting in a NULL pointer dereference. The attack vector is local through ioctl calls to DASD devices. The vulnerability affects Linux kernel versions 5.3 and later. A patch is available that changes the condition from AND to OR, preventing the NULL pointer dereference.
Affected products
- Linux Linux kernel 5.3 and later
Timeline
- 2026-08-28: disclosed
- 2026-08-09: patched