CVE-2026-98024: s390/ism: folio_put() after error
In the Linux kernel, the following vulnerability has been resolved:
s390/ism: folioput() after error
dmb->cpuaddr was allocated via folioalloc(). Use folioput() instead of kfree() in the error exit of ismallocdmb() to avoid slab allocator corruption.
While at it, reset dmb->cpuaddr after folioput to avoid unintentional UAF by future callers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is in the Linux kernel s390 ISM code path. Systems not using that code path are not identified by the provided information as affected.
What conditions are needed to trigger the flaw?
An error exit in ism_alloc_dmb() must occur after dmb->cpu_addr has been allocated with folio_alloc(). The incorrect kfree() on that allocation can corrupt the slab allocator.
What is the remediation when updating the kernel?
Apply a kernel update containing the referenced fix. The correction releases the allocation with folio_put() and clears dmb->cpu_addr afterward to prevent future use-after-free.