CVE-2026-97593
Received Received - Intake

NULL Pointer Dereference in Linux Kernel iommu/s390

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX get_rso_from_iova() returns NULL when the region-first entry is invalid. Yet in get_rto_from_iova() the region-second origin rso is not checked to be non-NULL before accessing rso[rsx] leading to a NULL pointer dereference instead of a NULL return when iova_to_phys() is called on a unmapped IOVA. Fix this by adding the missing NULL check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97593
EUVD
EUVD-2026-86901

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's IOMMU subsystem for s390 architecture. It occurs when using 5-level translation tables via ZPCI_TABLE_TYPE_RFX. The function get_rso_from_iova() returns NULL for invalid region-first entries, but get_rto_from_iova() fails to check this NULL value before accessing memory, causing a crash instead of proper handling.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU implementation for s390 architecture with ZPCI_TABLE_TYPE_RFX. Detection requires checking kernel logs for NULL pointer dereference errors related to iova_to_phys() or get_rto_from_iova(). Look for kernel oops or crash messages indicating NULL pointer dereference in IOMMU operations.

Impact Analysis

This vulnerability could cause system crashes or kernel panics when processing unmapped IOVA addresses in systems using s390 architecture with ZPCI_TABLE_TYPE_RFX translation tables. This may lead to denial of service conditions for affected systems.

Mitigation Strategies

Apply the kernel patch that fixes the NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX. Update to a patched kernel version where this issue is resolved. If immediate patching is not possible, consider disabling IOMMU for s390 ZPCI devices as a temporary workaround, though this may impact security and functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97593. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart