LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel()

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel defect in s390 channel I/O device handling. A failed DMA mask setup can free an initialized device incorrectly, creating potential use-after-free or double-free conditions. The public bundle does not provide CVSS, exploit evidence, or distro package mappings.

Executive priority

Treat this as a kernel maintenance priority for s390 environments, not an emergency based on current public evidence. Escalate if vendor guidance rates your deployed kernel as affected.

Technical view

In css_alloc_subchannel(), device_initialize() occurs before DMA mask setup. If dma_set_coherent_mask() or dma_set_mask() fails, the old error path called kfree() directly instead of dropping the device reference with put_device(), bypassing the kernel device model release flow.

Likely exposure

Exposure appears limited to affected Linux kernels using the s390/cio code path. The bundle lists Linux as affected but does not map fixes to specific distributions, packages, or enterprise kernel builds.

Exploitation context

No active exploitation is stated. The CVE is not marked KEV, and the supplied sources only describe the kernel lifetime bug and stable fixes, not exploitability in real environments.

Researcher notes

The key behavior is incorrect lifetime handling after device_initialize() in css_alloc_subchannel(). Evidence supports potential memory safety impact, but the bundle lacks CVSS, reachable attack path, required privileges, and distro-specific affected ranges.

Mitigation direction

  • Update affected Linux kernels to builds containing the relevant stable fix.
  • Check your distribution vendor advisory for patched package versions.
  • Prioritize s390 production hosts and systems with strict availability requirements.
  • Avoid relying on upstream commit hashes alone for distro kernels.

Validation and detection

  • Inventory Linux kernel versions and identify s390 systems.
  • Confirm whether vendor kernel packages include the stable fix commits.
  • Review change records for updates after the CVE publication date.
  • Track vendor advisories until package mapping is explicit.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-45981 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe5dcf0025d7af58f525590ac86ac27cb44714e8d, e5dcf0025d7af58f525590ac86ac27cb44714e8d, e5dcf0025d7af58f525590ac86ac27cb44714e8d, e5dcf0025d7af58f525590ac86ac27cb44714e8d, e5dcf0025d7af58f525590ac86ac27cb44714e8dunaffected
LinuxLinux3.10, 0, 6.6.128, 6.12.75, 6.18.14, 6.19.4, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.