CVE-2026-89457

Received Received - Intake

s390 DASD sysfs callback NULL pointer dereference

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device->private, either directly or through the DASD_DEFINE_ATTR() macro. During dasd_generic_set_online() the discipline is assigned before check_device() allocates device->private, so an unprivileged read of one of these world-readable attributes in that window dereferences a NULL pointer and panics. Guard the dereference inside each callback that actually touches device->private.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89457

EUVD

EUVD-2026-76363

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where sysfs show/store handlers call a discipline callback that dereferences device->private before it is allocated. This causes a NULL pointer dereference and kernel panic when unprivileged users read certain world-readable attributes during a specific window in device initialization.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/dasd driver and may cause a kernel panic if exploited. Detection requires checking kernel logs for crashes or examining sysfs attributes related to DASD devices. Commands like dmesg | grep -i panic or ls -l /sys/bus/ccw/drivers/dasd-eckd/ may help identify affected systems.

Impact Analysis

This vulnerability could cause a system crash (kernel panic) if an unprivileged user reads specific sysfs attributes during device initialization. This leads to denial of service for the entire system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue causing a NULL pointer dereference in sysfs handlers, leading to a system panic. Compliance impacts would only occur if the vulnerability enabled unauthorized data access or processing, which is not indicated here.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the vulnerability. If immediate patching is not possible, restrict access to sysfs attributes for DASD devices to prevent unauthorized reads during the vulnerable window.

Hi! I’m here to help you understand CVE-2026-89457. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70