PT-2026-43848 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-45981

Mitre

In the Linux kernel, the following vulnerability has been resolved:

s390/cio: Fix device lifecycle handling in css alloc subchannel()

css alloc subchannel() calls device initialize() before setting up the DMA masks. If dma set coherent mask() or dma set mask() fails, the error path frees the subchannel structure directly, bypassing the device model reference counting.

Once device initialize() has been called, the embedded struct device must be released via put device(), allowing the release callback to free the container structure.

Fix the error path by dropping the initial device reference with put device() instead of calling kfree() directly.

This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues.

Related Identifiers

CVE-2026-45981

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-45981 · Security Note
• https://git.kernel.org/stable/c/6715560527e343a387e4a0d2e6c401748e89fa55 · Note
• https://git.kernel.org/stable/c/fd295a75d828c11acfcc6869c2a12cdaaf9b7722 · Note
• https://git.kernel.org/stable/c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424 · Note
• https://git.kernel.org/stable/c/b1d4e6fb241672850296956c4d782a69363a3807 · Note
• https://git.kernel.org/stable/c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 · Note
• https://git.kernel.org/stable/c/c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603 · Note
• https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 · Note
• https://git.kernel.org/stable/c/2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681 · Note