Executive Summary

This vulnerability exists in the Linux kernel's s390 architecture code, specifically in the function css_alloc_subchannel(). The function calls device_initialize() before setting up DMA masks. If setting the DMA masks fails, the error handling code incorrectly frees the subchannel structure directly using kfree(), bypassing the proper device model reference counting.

Because device_initialize() has been called, the embedded device structure must be released using put_device() to properly decrement the reference count and trigger the release callback that frees the container structure. The incorrect error path leads to improper device lifetime handling, which can cause use-after-free or double-free issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory management errors such as use-after-free or double-free conditions in the Linux kernel. Such errors may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the improper handling of device lifecycles.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by fixing the device lifecycle handling in the Linux kernel's s390/cio subsystem. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for CVE-2026-45981.

Specifically, ensure your kernel includes the patch that changes the error path in css_alloc_subchannel() to call put_device() instead of kfree(), which properly manages device references and prevents use-after-free or double-free issues.

Useful 0 Not Useful 0