CVE-2026-89457 - Vulnerability Details

- s390/dasd: Guard sysfs discipline callbacks against unallocated private data

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Guard sysfs discipline callbacks against unallocated private data

Several sysfs show/store handlers call a discipline callback that
dereferences device->private, either directly or through the
DASD_DEFINE_ATTR() macro. During dasd_generic_set_online() the discipline
is assigned before check_device() allocates device->private, so an
unprivileged read of one of these world-readable attributes in that window
dereferences a NULL pointer and panics.

Guard the dereference inside each callback that actually touches
device->private.

Published: 2026-09-11

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null-pointer dereference exists in the s390 DASD driver when sysfs show/store handlers call a discipline callback that accesses device->private before that member is allocated. During dasd_generic_set_online the callback is registered immediately, and if an unprivileged user reads a specific sysfs attribute during a short window the kernel dereferences a NULL pointer and triggers a panic, causing the system.

Affected Systems

All Linux kernel builds containing the s390 DASD driver before the patch are affected. The exact kernel versions affected are not listed, but any kernel that has not incorporated the recent commit fixing the guard on sysfs callbacks is vulnerable.

Risk and Exploitability

The CVSS score of 4.7 indicates a moderate severity. The EPSS score of 0.00168 (< 1%) indicates an extremely low exploitation probability, and the issue is not in CISA’s KEV catalog. Exploitation requires an unprivileged user to read a specific sysfs attribute during a brief allocation window created by dasd_generic_set_online. While the window is narrow, the potential impact of a kernel panic is high, but practical exploitation is limited to systems using the affected driver.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c729696bcf8b23450043dd9c9972c15e53419ae4`	affected	< 536407b272402af679155910d7fdeeb4834eefb9
`c729696bcf8b23450043dd9c9972c15e53419ae4`	affected	< 6452c13646af7c13d7f6668b6690cfb2427e7f7b
`c729696bcf8b23450043dd9c9972c15e53419ae4`	affected	< 449f3bada7a9fad8b8cdf4bb20baf27ee9ca56c5
`c729696bcf8b23450043dd9c9972c15e53419ae4`	affected	< 2a1780f9fc2493bd34c418a0be6fc58943afcecf

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c729696bcf8b23450043dd9c9972c15e53419ae4,536407b272402af679155910d7fdeeb4834eefb9)`	affected	code_commit	—
`[c729696bcf8b23450043dd9c9972c15e53419ae4,6452c13646af7c13d7f6668b6690cfb2427e7f7b)`	affected	code_commit	—
`[c729696bcf8b23450043dd9c9972c15e53419ae4,449f3bada7a9fad8b8cdf4bb20baf27ee9ca56c5)`	affected	code_commit	—
`[c729696bcf8b23450043dd9c9972c15e53419ae4,2a1780f9fc2493bd34c418a0be6fc58943afcecf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch fixing the NULL pointer dereference in the s390 DASD driver.
If an upgrade is not yet possible, restrict or remove the world-readable sysfs attributes for the DASD driver, or disable the DASD subsystem when it is not needed.
Deploy a local security patch by applying the specific commit from the kernel repository or by building the kernel with the safety guard enabled for device->private access.
Monitor system logs for kernel panics or crashes related to dasd to detect accidental triggers during the allocation window.

Generated by OpenCVE AI on September 13, 2026 at 03:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2a1780f9fc2493bd34c418a0be6fc58943afcecf
https://git.kernel.org/stable/c/449f3bada7a9fad8b8cdf4bb20baf27ee9ca56c5
https://git.kernel.org/stable/c/536407b272402af679155910d7fdeeb4834eefb9
https://git.kernel.org/stable/c/6452c13646af7c13d7f6668b6690cfb2427e7f7b
https://nvd.nist.gov/vuln/detail/CVE-2026-89457
https://www.cve.org/CVERecord?id=CVE-2026-89457

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89457 https://www.cve.org/CVERecord?id=CVE-2026-89457
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device->private, either directly or through the DASD_DEFINE_ATTR() macro. During dasd_generic_set_online() the discipline is assigned before check_device() allocates device->private, so an unprivileged read of one of these world-readable attributes in that window dereferences a NULL pointer and panics. Guard the dereference inside each callback that actually touches device->private.
Title		s390/dasd: Guard sysfs discipline callbacks against unallocated private data
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2a1780f9fc2493bd34c418a0be6fc58943afcecf https://git.kernel.org/stable/c/449f3bada7a9fad8b8cdf4bb20baf27ee9ca56c5 https://git.kernel.org/stable/c/536407b272402af679155910d7fdeeb4834eefb9 https://git.kernel.org/stable/c/6452c13646af7c13d7f6668b6690cfb2427e7f7b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:20.701Z

Updated: 2026-09-11T19:43:20.701Z

Reserved: 2026-09-11T19:38:34.707Z

Link: CVE-2026-89457

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:26.527

Modified: 2026-09-11T20:19:26.527

Link: CVE-2026-89457

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:20Z

Links: CVE-2026-89457 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T16:30:13Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object