Executive brief
The Linux kernel's s390 DASD (Direct Access Storage Device) subsystem has a race condition in its sysfs interface. When a storage device is brought online, unprivileged users can read world-readable sysfs attributes before internal data structures are fully initialized, causing a kernel panic. This can be exploited to crash systems running s390-based mainframes, disrupting storage operations and requiring manual intervention to restart.
Technical details
This vulnerability is a null pointer dereference in the s390 DASD driver's sysfs discipline callbacks. The root cause is a race condition during dasd_generic_set_online(): the device discipline is assigned before the check_device() function allocates the private data structure. Between these two operations, an unprivileged user can read world-readable sysfs attributes (such as ESE volume info, extent pool ID, or space allocation), causing the callbacks to dereference a NULL device->private pointer and trigger a kernel panic. The fix adds NULL pointer checks at the beginning of each affected callback function before dereferencing device->private. The vulnerability affects multiple DASD-related callbacks across the driver and requires no special privileges or authentication to trigger.
Affected products
- Linux Linux Kernel Affected versions prior to fix (2026-08-05); s390 architecture (mainframe)
Timeline
- 2026-09-11: disclosed: CVE-2026-89457 published on NVD
- 2026-08-05: patched: Fix committed upstream (2a1780f9fc2493bd34c418a0be6fc58943afcecf)