CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
In the Linux kernel, the following vulnerability has been resolved:
s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
`css_alloc_subchannel()` calls `device_initialize()` before setting up
the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails,
the error path frees the subchannel structure directly, bypassing
the device model reference counting.
Once `device_initialize()` has been called, the embedded struct device
must be released via `put_device()`, allowing the release callback to
free the container structure.
Fix the error path by dropping the initial device reference with
`put_device()` instead of calling `kfree()` directly.
This ensures correct device lifetime handling and avoids potential
use-after-free or double-free issues.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel defect in s390 channel I/O device handling. A failed DMA mask setup can free an initialized device incorrectly, creating potential use-after-free or double-free conditions. The public bundle does not provide CVSS, exploit evidence, or distro package mappings.
Executive priority
Treat this as a kernel maintenance priority for s390 environments, not an emergency based on current public evidence. Escalate if vendor guidance rates your deployed kernel as affected.
Technical view
In css_alloc_subchannel(), device_initialize() occurs before DMA mask setup. If dma_set_coherent_mask() or dma_set_mask() fails, the old error path called kfree() directly instead of dropping the device reference with put_device(), bypassing the kernel device model release flow.
Likely exposure
Exposure appears limited to affected Linux kernels using the s390/cio code path. The bundle lists Linux as affected but does not map fixes to specific distributions, packages, or enterprise kernel builds.
Exploitation context
No active exploitation is stated. The CVE is not marked KEV, and the supplied sources only describe the kernel lifetime bug and stable fixes, not exploitability in real environments.
Researcher notes
The key behavior is incorrect lifetime handling after device_initialize() in css_alloc_subchannel(). Evidence supports potential memory safety impact, but the bundle lacks CVSS, reachable attack path, required privileges, and distro-specific affected ranges.
Mitigation direction
Update affected Linux kernels to builds containing the relevant stable fix.
Check your distribution vendor advisory for patched package versions.
Prioritize s390 production hosts and systems with strict availability requirements.
Avoid relying on upstream commit hashes alone for distro kernels.
Validation and detection
Inventory Linux kernel versions and identify s390 systems.
Confirm whether vendor kernel packages include the stable fix commits.
Review change records for updates after the CVE publication date.
Track vendor advisories until package mapping is explicit.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
description · low confidence lookup
Container behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
6Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 27, 2026, 12:18 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.