CVE-2026-89457: s390/dasd: Guard sysfs discipline callbacks against unallocated private data
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
Several sysfs show/store handlers call a discipline callback that dereferences device->private, either directly or through the DASDDEFINEATTR() macro. During dasdgenericsetonline() the discipline is assigned before checkdevice() allocates device->private, so an unprivileged read of one of these world-readable attributes in that window dereferences a NULL pointer and panics.
Guard the dereference inside each callback that actually touches device->private.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel DASD driver on s390 are exposed during the interval in which a DASD device is being brought online after its discipline is assigned but before its private data is allocated. A local unprivileged user can trigger the issue because the affected sysfs attributes are world-readable.
What does an attacker need to do to exploit it?
An attacker needs local access and must read an affected DASD sysfs attribute during the narrow device-online initialization window. The resulting NULL-pointer dereference can panic the kernel.
Are default permissions sufficient for exploitation?
Yes. The affected attributes are described as world-readable, so exploitation does not require elevated privileges to read them.
What should be done if patching cannot happen immediately?
The provided information does not specify a workaround. Reducing untrusted local access while DASD devices are being brought online may reduce exposure, but the described fix is to guard callbacks that access device private data.