PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45981 Linux CVE debrief

A vulnerability in the Linux kernel's s390 Channel I/O (CIO) subsystem has been resolved. The issue was in `css_alloc_subchannel()`, where improper device lifecycle handling in an error path could lead to use-after-free or double-free conditions. Specifically, after `device_initialize()` was called, subsequent DMA mask setup failures triggered a direct `kfree()` of the subchannel structure instead of using `put_device()`, bypassing the device model's reference counting. The fix ensures proper cleanup by using `put_device()` to release the initial device reference, allowing the release callback to handle memory deallocation correctly.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

System administrators and security teams managing IBM Z (s390/s390x) mainframe systems running Linux, particularly those utilizing Channel I/O devices. Organizations with high-availability requirements on zSystems infrastructure should prioritize this fix due to the potential for memory corruption in device initialization paths.

Technical summary

The vulnerability exists in `css_alloc_subchannel()` in the Linux kernel's s390 Channel I/O (CIO) code. The function calls `device_initialize()` before setting up DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the original error path incorrectly called `kfree()` directly on the subchannel structure. Since `device_initialize()` had already been invoked, the embedded struct device had an active reference count, and direct kfree() bypassed proper device model cleanup. This could result in use-after-free or double-free memory corruption. The fix replaces the direct kfree() with `put_device()`, which properly decrements the reference count and allows the device's release callback to free the container structure when appropriate.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the referenced commits
  • For s390/zSystems environments, prioritize kernel patching to prevent potential memory corruption in Channel I/O device initialization
  • Verify kernel version includes fixes from the referenced stable branch commits
  • Monitor vendor security advisories for specific patch availability

Evidence notes

The CVE description and source references confirm this is a resolved Linux kernel vulnerability affecting the s390 architecture's Channel I/O subsystem. Multiple stable kernel branch commits are referenced, indicating backports to various supported kernel versions. The vulnerability status in NVD is 'Awaiting Analysis' as of the source publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45981 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45981

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45981 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45981

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6715560527e343a387e4a0d2e6c401748e89fa55

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b1d4e6fb241672850296956c4d782a69363a3807

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.