CVE-2026-97980: s390/debug: Fix NULL pointer dereference in debug_set_level()
In the Linux kernel, the following vulnerability has been resolved:
s390/debug: Fix NULL pointer dereference in debugsetlevel()
Commit a2cec6863709 ("s390/debug: Add s390dbf kernel parameter") incorrectly removed a null-id check from debugsetlevel(), introducing a possible NULL pointer dereference for debug-API users that put debugregister() results unchecked into debugsetlevel().
Fix this by moving the check from the internal debugsetlevel() variant back to the external debugsetlevel() wrapper.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Move the NULL-pointer check from the internal _debug_set_level() function back to the external debug_set_level() wrapper, preventing unchecked debug_register() results from reaching the internal function.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when s390 debug-API users pass an unchecked result from debug_register() to debug_set_level(). The issue is specific to the Linux kernel s390 debug subsystem.
What condition is required to trigger the NULL pointer dereference?
debug_register() must return a NULL identifier, and a caller must pass that unchecked result to debug_set_level(). The removed NULL-ID check allowed debug_set_level() to dereference it.
How can I determine whether my kernel includes the fix?
Check whether the kernel contains either referenced stable commit 716e1cd3783806929407dbd596e6b1118971eb9e or b1eb31d533cdfcae1011ed53850d52f36afe5774. The fix restores the NULL-ID check in the external debug_set_level() wrapper.