CVE-2026-98474

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98474", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.351Z", "datePublished": "2026-10-18T15:15:36.667Z", "dateUpdated": "2026-10-19T09:20:12.011Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:12.011Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Fix missing device lock in zpci_report_status()\n\nWhen pdev is non-NULL, zpci_report_status() accesses the device's driver.\nTo get a consistent state matching the recovery, the device lock needs to\nbe held. Do so by expanding the existing device lock critical section.\n\nThe lock only needs to be held when the pdev is non-NULL, so extract\nthe pdev-specific reporting into a helper function which also adds a\nlockdep assertion to detect calls without the device lock held."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/pci/pci_event.c", "arch/s390/pci/pci_report.c"], "versions": [{"version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6", "lessThan": "743a8458978d13d84a1cf74bcd29b9959a75d3a0", "status": "affected", "versionType": "git"}, {"version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6", "lessThan": "1b957d5c2f737cda731cb1a1b71a7524d54538f2", "status": "affected", "versionType": "git"}, {"version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6", "lessThan": "0261aef4b15efcee2860ab857e5cb05e9bfa47b0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/pci/pci_event.c", "arch/s390/pci/pci_report.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/743a8458978d13d84a1cf74bcd29b9959a75d3a0"}, {"url": "https://git.kernel.org/stable/c/1b957d5c2f737cda731cb1a1b71a7524d54538f2"}, {"url": "https://git.kernel.org/stable/c/0261aef4b15efcee2860ab857e5cb05e9bfa47b0"}], "title": "s390/pci: Fix missing device lock in zpci_report_status()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/s390/pci/pci_event.c", "arch/s390/pci/pci_report.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "743a8458978d13d84a1cf74bcd29b9959a75d3a0", "status": "affected", "version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6", "versionType": "git"}, {"lessThan": "1b957d5c2f737cda731cb1a1b71a7524d54538f2", "status": "affected", "version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6", "versionType": "git"}, {"lessThan": "0261aef4b15efcee2860ab857e5cb05e9bfa47b0", "status": "affected", "version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/s390/pci/pci_event.c", "arch/s390/pci/pci_report.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Fix missing device lock in zpci_report_status()\n\nWhen pdev is non-NULL, zpci_report_status() accesses the device's driver.\nTo get a consistent state matching the recovery, the device lock needs to\nbe held. Do so by expanding the existing device lock critical section.\n\nThe lock only needs to be held when the pdev is non-NULL, so extract\nthe pdev-specific reporting into a helper function which also adds a\nlockdep assertion to detect calls without the device lock held."}], "id": "CVE-2026-98474", "lastModified": "2026-10-19T10:18:58.000", "metrics": {}, "published": "2026-10-18T16:16:57.927", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0261aef4b15efcee2860ab857e5cb05e9bfa47b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b957d5c2f737cda731cb1a1b71a7524d54538f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/743a8458978d13d84a1cf74bcd29b9959a75d3a0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/pci: Fix missing device lock in zpci_report_status()", "id": "2554841", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554841"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel's s390 PCI subsystem. This flaw can lead to a Denial of Service (DoS) due to a missing device lock during PCI (Peripheral Component Interconnect) error recovery. When error recovery status is reported without proper locking, concurrent device operations can access driver data in an inconsistent state, potentially causing the operating system to crash."], "name": "CVE-2026-98474", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98474\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98474\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98474.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ec6054e7321dc24ebccaa08b3af0d590f5666e6,743a8458978d13d84a1cf74bcd29b9959a75d3a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ec6054e7321dc24ebccaa08b3af0d590f5666e6,1b957d5c2f737cda731cb1a1b71a7524d54538f2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ec6054e7321dc24ebccaa08b3af0d590f5666e6,0261aef4b15efcee2860ab857e5cb05e9bfa47b0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T16:45:17.334263+00:00", "updated": "2026-10-23T08:15:17.496451+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}