CVE-2026-98024 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/ism: folio_put() after error

dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of
kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator
corruption.

While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF
by future callers.

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the s390/ism subsystem incorrectly releases memory allocated with folio_alloc() by calling kfree() rather than folio_put(). This misuse corrupts the slab allocator state, potentially causing unstable kernel behavior. To mitigate future use‑after‑free scenarios, the patch also clears dmb->cpu_addr after folio_put(). The vulnerability is classified as CWE‑763: Incorrect Handle Management.

Affected Systems

The flaw affects any Linux kernel image that includes the s390/ism subsystem and has not yet applied the patch. All distributions using the default kernel on S/390 architecture are subject to this issue unless they upgrade to a build that incorporates the fix.

Risk and Exploitability

The EPSS score of less than 1 % indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects medium‑to‑low severity. Because the problem occurs in kernel space, it is inferred that an attacker would need local access; the CVE description does not provide evidence of remote or privilege‑escalation impact.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`121fb75414ab8debafd548bded9d888cd5a8f165`	affected	< 90f6f5cb331af52b14c0f309fb27dc243e8e2982
`83781384a96b95e2b6403d3c8a002b2c89031770`	affected	< 890e2ef726904d1d8328e4b9f5090eeb8761b9d1
`83781384a96b95e2b6403d3c8a002b2c89031770`	affected	< eebb6a9017b55ac05be770cf7b89f9da49505ae7
`83781384a96b95e2b6403d3c8a002b2c89031770`	affected	< 60983356fab0c1171c5cb1b56a36349ebadc608e
`83781384a96b95e2b6403d3c8a002b2c89031770`	affected	< 907a56ab3eb8a58500a58daa76087f17bb2b6826
`f3e23edc4917f72139b805f208aeadf23376a0b5`	affected	—
`6.6.29`	affected	< 6.6.158
`6.8.8`	affected	< 6.9

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[83781384a96b95e2b6403d3c8a002b2c89031770,890e2ef726904d1d8328e4b9f5090eeb8761b9d1)`	affected	code_commit	—
`[83781384a96b95e2b6403d3c8a002b2c89031770,eebb6a9017b55ac05be770cf7b89f9da49505ae7)`	affected	code_commit	—
`[83781384a96b95e2b6403d3c8a002b2c89031770,60983356fab0c1171c5cb1b56a36349ebadc608e)`	affected	code_commit	—
`[83781384a96b95e2b6403d3c8a002b2c89031770,907a56ab3eb8a58500a58daa76087f17bb2b6826)`	affected	code_commit	—
`121fb75414ab8debafd548bded9d888cd5a8f165`	affected	code_commit	—
`f3e23edc4917f72139b805f208aeadf23376a0b5`	affected	code_commit	—
`[6.6.29,6.7)`	affected	semver	—
`[6.8.8,6.9)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	semver	—
`[0,6.9)`	unaffected	semver	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2.7,7.2.*]`	unaffected	generic	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that replaces kfree() with folio_put() in ism_alloc_dmb()
Rebuild any custom kernel modules or drivers that interact with ism_alloc_dmb() to use the corrected deallocation path
Upgrade to a kernel version that includes the patch if it cannot be applied directly

Generated by OpenCVE AI on October 1, 2026 at 04:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98024.mbox
https://git.kernel.org/stable/c/60983356fab0c1171c5cb1b56a36349ebadc608e
https://git.kernel.org/stable/c/890e2ef726904d1d8328e4b9f5090eeb8761b9d1
https://git.kernel.org/stable/c/907a56ab3eb8a58500a58daa76087f17bb2b6826
https://git.kernel.org/stable/c/90f6f5cb331af52b14c0f309fb27dc243e8e2982
https://git.kernel.org/stable/c/eebb6a9017b55ac05be770cf7b89f9da49505ae7
https://nvd.nist.gov/vuln/detail/CVE-2026-98024
https://www.cve.org/CVERecord?id=CVE-2026-98024

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/90f6f5cb331af52b14c0f309fb27dc243e8e2982

Tue, 29 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-763
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98024.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98024 https://www.cve.org/CVERecord?id=CVE-2026-98024
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio_put() after error dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator corruption. While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF by future callers.
Title		s390/ism: folio_put() after error
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/60983356fab0c1171c5cb1b56a36349ebadc608e https://git.kernel.org/stable/c/890e2ef726904d1d8328e4b9f5090eeb8761b9d1 https://git.kernel.org/stable/c/907a56ab3eb8a58500a58daa76087f17bb2b6826 https://git.kernel.org/stable/c/eebb6a9017b55ac05be770cf7b89f9da49505ae7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:43.306Z

Updated: 2026-10-19T09:12:29.352Z

Reserved: 2026-09-25T10:19:56.070Z

Link: CVE-2026-98024

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:30.997

Modified: 2026-10-19T10:17:56.343

Link: CVE-2026-98024

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98024 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T04:15:16Z

Weaknesses

CWE-763
Release of Invalid Pointer or Reference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object