{"id":"CVE-2026-98476","summary":"s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()\n\nThe channel path registry entry associated with a CHPID may be removed\nwhile the subchannel's PMCW still references that CHPID. In this case,\nchpid_to_chp() can return NULL, leading to a NULL pointer dereference.\n\nAdd the missing NULL check before dereferencing the returned pointer.","modified":"2026-10-20T02:30:23.418030409Z","published":"2026-10-18T15:15:45.100Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98476.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/27e396a89f76f742abdbe9f8c4a58a6e806fdf59"},{"type":"WEB","url":"https://git.kernel.org/stable/c/44b16b02608058fc72198ac0205969f0f43065df"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5b76268dac968612f7283d59b539036de955b7d9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5e006ac90a4d331db1dd712b91fec849b45ffc01"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5fc54e04dad90b15d0430118b3f288a1d64e66c9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9d8b21820caed9128945fffcedf03e2a4c21eee2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c3bbcb32deecc06ebb1762398399b566d5ff2fc9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dbf30e661ceb9a52c94c85719716391dcc29142a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98476.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98476"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"199652309a4d6635fca19d7528d73ab9e219bd9a"},{"fixed":"9d8b21820caed9128945fffcedf03e2a4c21eee2"},{"fixed":"5fc54e04dad90b15d0430118b3f288a1d64e66c9"},{"fixed":"27e396a89f76f742abdbe9f8c4a58a6e806fdf59"},{"fixed":"dbf30e661ceb9a52c94c85719716391dcc29142a"},{"fixed":"5e006ac90a4d331db1dd712b91fec849b45ffc01"},{"fixed":"c3bbcb32deecc06ebb1762398399b566d5ff2fc9"},{"fixed":"44b16b02608058fc72198ac0205969f0f43065df"},{"fixed":"5b76268dac968612f7283d59b539036de955b7d9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98476.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.0"},{"fixed":"5.10.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.222"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.189"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.158"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.112"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.55"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98476.json"}}],"schema_version":"1.9.0"}