CVE-2026-98024 PUBLISHED

s390/ism: folio_put() after error

Assigner: Linux
Reserved: 25.09.2026 Published: 25.09.2026 Updated: 25.09.2026

In the Linux kernel, the following vulnerability has been resolved:

s390/ism: folio_put() after error

dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator corruption.

While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF by future callers.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 83781384a96b95e2b6403d3c8a002b2c89031770 to 890e2ef726904d1d8328e4b9f5090eeb8761b9d1 (excl.)
  • affected from 83781384a96b95e2b6403d3c8a002b2c89031770 to eebb6a9017b55ac05be770cf7b89f9da49505ae7 (excl.)
  • affected from 83781384a96b95e2b6403d3c8a002b2c89031770 to 60983356fab0c1171c5cb1b56a36349ebadc608e (excl.)
  • affected from 83781384a96b95e2b6403d3c8a002b2c89031770 to 907a56ab3eb8a58500a58daa76087f17bb2b6826 (excl.)
  • Version 121fb75414ab8debafd548bded9d888cd5a8f165 is affected
  • Version f3e23edc4917f72139b805f208aeadf23376a0b5 is affected
  • affected from 6.6.29 to 6.7 (excl.)
  • affected from 6.8.8 to 6.9 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.9 is affected
  • unaffected from 0 to 6.9 (excl.)
  • unaffected from 6.12.111 to 6.12.* (incl.)
  • unaffected from 6.18.53 to 6.18.* (incl.)
  • unaffected from 7.2.7 to 7.2.* (incl.)
  • unaffected from 7.3-rc3 to * (incl.)

References