CVE-2026-98474
Received Received - Intake

Linux kernel PCI device lock missing in status reporting

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpci_report_status() When pdev is non-NULL, zpci_report_status() accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the existing device lock critical section. The lock only needs to be held when the pdev is non-NULL, so extract the pdev-specific reporting into a helper function which also adds a lockdep assertion to detect calls without the device lock held.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98474
EUVD
EUVD-2026-103714

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 4ec6054e7321dc24ebccaa08b3af0d590f5666e6
Linux Linux 4ec6054e7321dc24ebccaa08b3af0d590f5666e6
Linux Linux 4ec6054e7321dc24ebccaa08b3af0d590f5666e6
Linux Linux 6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability affecting the s390/pci subsystem. The issue is in the function zpci_report_status() where a missing device lock can lead to inconsistent state when accessing the device's driver. The fix involves expanding the device lock critical section to ensure proper synchronization during device recovery.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/pci subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying if the affected function zpci_report_status() is called without proper device lock handling. Commands like dmesg or journalctl may show relevant errors. No direct network detection is applicable.

Impact Analysis

This vulnerability could potentially allow race conditions during PCI device recovery in s390 systems. This might lead to system instability, crashes, or unexpected behavior in systems using affected Linux kernel versions. The impact is primarily on systems with s390/pci hardware.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Reboot the system after patching to ensure the updated kernel is active. Monitor system logs for any recurrence of the issue after applying fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart