The Linux kernel’s s390/cio subsystem contains a missing NULL check when translating a channel path identifier to a channel path descriptor; if a channel path registry entry is removed while a subchannel’s PMCW still references that identifier, the helper function can return NULL and its dereference causes a kernel crash. This leads to an immediate loss of system availability for the affected node.

Any Linux kernel that includes the unpatched s390/cio code—most mainline distributions built before the commit adding the check—are vulnerable. No specific version numbers are provided, so all kernels lacking the patch are considered at risk.

The CVSS score of 4.7 signals a low severity focusing on a crash rather than data exposure. The EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would likely be local and require privileges sufficient to trigger the subchannel removal scenario, typically root or an equivalent user.