Junglewise Threat Intelligence

CVE-2026-89457: Linux kernel s390/dasd null pointer dereference in sysfs

CVE-2026-89457 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's s390 DASD (Direct Access Storage Device) subsystem has a race condition in its sysfs interface. When a storage device is brought online, unprivileged users can read world-readable sysfs attributes before internal data structures are fully initialized, causing a kernel panic. This can be exploited to crash systems running s390-based mainframes, disrupting storage operations and requiring manual intervention to restart.

Technical details

This vulnerability is a null pointer dereference in the s390 DASD driver's sysfs discipline callbacks. The root cause is a race condition during dasd_generic_set_online(): the device discipline is assigned before the check_device() function allocates the private data structure. Between these two operations, an unprivileged user can read world-readable sysfs attributes (such as ESE volume info, extent pool ID, or space allocation), causing the callbacks to dereference a NULL device->private pointer and trigger a kernel panic. The fix adds NULL pointer checks at the beginning of each affected callback function before dereferencing device->private. The vulnerability affects multiple DASD-related callbacks across the driver and requires no special privileges or authentication to trigger.

Affected products

  • Linux Linux Kernel Affected versions prior to fix (2026-08-05); s390 architecture (mainframe)

Timeline

  • 2026-09-11: disclosed: CVE-2026-89457 published on NVD
  • 2026-08-05: patched: Fix committed upstream (2a1780f9fc2493bd34c418a0be6fc58943afcecf)

References

Related threats