CVE-2026-98024: s390/ism: folio_put() after error
In the Linux kernel, the following vulnerability has been resolved:
s390/ism: folioput() after error
dmb->cpuaddr was allocated via folioalloc(). Use folioput() instead of kfree() in the error exit of ismallocdmb() to avoid slab allocator corruption.
While at it, reset dmb->cpuaddr after folioput to avoid unintentional UAF by future callers.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is in the Linux kernel s390 ISM code path. Systems not using that code path are not identified by the provided information as affected.
What conditions are needed to trigger the flaw?
An error exit in ism_alloc_dmb() must occur after dmb->cpu_addr has been allocated with folio_alloc(). The incorrect kfree() on that allocation can corrupt the slab allocator.
What is the remediation when updating the kernel?
Apply a kernel update containing the referenced fix. The correction releases the allocation with folio_put() and clears dmb->cpu_addr afterward to prevent future use-after-free.