CVE-2026-98024

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98024", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.070Z", "datePublished": "2026-09-25T10:23:43.306Z", "dateUpdated": "2026-10-19T09:12:29.352Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:29.352Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ism: folio_put() after error\n\ndmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of\nkfree() in the error exit of ism_alloc_dmb() to avoid slab allocator\ncorruption.\n\nWhile at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF\nby future callers."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/net/ism_drv.c"], "versions": [{"version": "121fb75414ab8debafd548bded9d888cd5a8f165", "lessThan": "90f6f5cb331af52b14c0f309fb27dc243e8e2982", "status": "affected", "versionType": "git"}, {"version": "83781384a96b95e2b6403d3c8a002b2c89031770", "lessThan": "890e2ef726904d1d8328e4b9f5090eeb8761b9d1", "status": "affected", "versionType": "git"}, {"version": "83781384a96b95e2b6403d3c8a002b2c89031770", "lessThan": "eebb6a9017b55ac05be770cf7b89f9da49505ae7", "status": "affected", "versionType": "git"}, {"version": "83781384a96b95e2b6403d3c8a002b2c89031770", "lessThan": "60983356fab0c1171c5cb1b56a36349ebadc608e", "status": "affected", "versionType": "git"}, {"version": "83781384a96b95e2b6403d3c8a002b2c89031770", "lessThan": "907a56ab3eb8a58500a58daa76087f17bb2b6826", "status": "affected", "versionType": "git"}, {"version": "f3e23edc4917f72139b805f208aeadf23376a0b5", "status": "affected", "versionType": "git"}, {"version": "6.6.29", "lessThan": "6.6.158", "status": "affected", "versionType": "semver"}, {"version": "6.8.8", "lessThan": "6.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/net/ism_drv.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.29", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/90f6f5cb331af52b14c0f309fb27dc243e8e2982"}, {"url": "https://git.kernel.org/stable/c/890e2ef726904d1d8328e4b9f5090eeb8761b9d1"}, {"url": "https://git.kernel.org/stable/c/eebb6a9017b55ac05be770cf7b89f9da49505ae7"}, {"url": "https://git.kernel.org/stable/c/60983356fab0c1171c5cb1b56a36349ebadc608e"}, {"url": "https://git.kernel.org/stable/c/907a56ab3eb8a58500a58daa76087f17bb2b6826"}], "title": "s390/ism: folio_put() after error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/s390/net/ism_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "90f6f5cb331af52b14c0f309fb27dc243e8e2982", "status": "affected", "version": "121fb75414ab8debafd548bded9d888cd5a8f165", "versionType": "git"}, {"lessThan": "890e2ef726904d1d8328e4b9f5090eeb8761b9d1", "status": "affected", "version": "83781384a96b95e2b6403d3c8a002b2c89031770", "versionType": "git"}, {"lessThan": "eebb6a9017b55ac05be770cf7b89f9da49505ae7", "status": "affected", "version": "83781384a96b95e2b6403d3c8a002b2c89031770", "versionType": "git"}, {"lessThan": "60983356fab0c1171c5cb1b56a36349ebadc608e", "status": "affected", "version": "83781384a96b95e2b6403d3c8a002b2c89031770", "versionType": "git"}, {"lessThan": "907a56ab3eb8a58500a58daa76087f17bb2b6826", "status": "affected", "version": "83781384a96b95e2b6403d3c8a002b2c89031770", "versionType": "git"}, {"status": "affected", "version": "f3e23edc4917f72139b805f208aeadf23376a0b5", "versionType": "git"}, {"lessThan": "6.6.158", "status": "affected", "version": "6.6.29", "versionType": "semver"}, {"lessThan": "6.9", "status": "affected", "version": "6.8.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/s390/net/ism_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ism: folio_put() after error\n\ndmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of\nkfree() in the error exit of ism_alloc_dmb() to avoid slab allocator\ncorruption.\n\nWhile at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF\nby future callers."}], "id": "CVE-2026-98024", "lastModified": "2026-10-19T10:17:56.343", "metrics": {}, "published": "2026-09-25T11:17:30.997", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/60983356fab0c1171c5cb1b56a36349ebadc608e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/890e2ef726904d1d8328e4b9f5090eeb8761b9d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/907a56ab3eb8a58500a58daa76087f17bb2b6826"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90f6f5cb331af52b14c0f309fb27dc243e8e2982"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eebb6a9017b55ac05be770cf7b89f9da49505ae7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/ism: folio_put() after error", "id": "2541050", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541050"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/ism: folio_put() after error\ndmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of\nkfree() in the error exit of ism_alloc_dmb() to avoid slab allocator\ncorruption.\nWhile at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF\nby future callers.", "A flaw was found in the Linux kernel's s390 Internal Shared Memory (ISM) driver. This flaw allows a local user to cause a Denial of Service (DoS) due to memory corruption. During an error condition while allocating direct memory buffers, the driver incorrectly frees memory pages using an improper deallocation function. This mishandling corrupts kernel slab memory and can lead to a system crash."], "name": "CVE-2026-98024", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98024\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98024\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98024.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[83781384a96b95e2b6403d3c8a002b2c89031770,890e2ef726904d1d8328e4b9f5090eeb8761b9d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[83781384a96b95e2b6403d3c8a002b2c89031770,eebb6a9017b55ac05be770cf7b89f9da49505ae7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[83781384a96b95e2b6403d3c8a002b2c89031770,60983356fab0c1171c5cb1b56a36349ebadc608e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[83781384a96b95e2b6403d3c8a002b2c89031770,907a56ab3eb8a58500a58daa76087f17bb2b6826)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "121fb75414ab8debafd548bded9d888cd5a8f165"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f3e23edc4917f72139b805f208aeadf23376a0b5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.29,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.8.8,6.9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:30:15.790138+00:00", "updated": "2026-10-01T04:15:16.825142+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}