rootpwn

critical · CVSS v3 7.1

CVE-2026-98024

CVE-2026-98024 is a critical flaw in the Linux kernel’s s390/ism subsystem that can corrupt the slab allocator and lead to a use‑after‑free.

Overview

CVE-2026-98024 is a critical flaw in the Linux kernel’s s390/ism subsystem that can corrupt the slab allocator and lead to a use‑after‑free. The bug occurs when folio_put() is incorrectly replaced by kfree() during error handling in ism_alloc_dmb(). It can allow attackers to gain arbitrary code execution or cause a denial of service on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio_put() after error dmb->cpu_addr was allocated via folio_alloc(). Use folio_put() instead of kfree() in the error exit of ism_alloc_dmb() to avoid slab allocator corruption. While at it, reset dmb->cpu_addr after folio_put to avoid unintentional UAF by future callers.

Impact

The vulnerability threatens confidentiality, integrity, and availability of systems running the s390 architecture. Attackers could execute arbitrary code, tamper with kernel data, or crash the system. Defenders on mainframe or s390 servers are directly impacted. The flaw is exploitable only on systems that load the affected kernel modules.

Remediation

Apply the vendor‑supplied kernel patch that replaces kfree() with folio_put() in ism_alloc_dmb() and resets dmb->cpu_addr. Update to the latest kernel release or backport the fix. Reboot the affected hosts after patching. If the s390/ism module is not required, consider unloading or disabling it to mitigate risk.

Risk context

The CVE is rated critical with a CVSS v3 score of 7.1. No EPSS data is available, but the severity indicates a high priority for patching. Defenders should prioritize updating kernels on s390 systems to eliminate the risk.

Affected products

  • Linux kernel (s390)
  • Red Hat Enterprise Linux
  • Ubuntu
  • Debian
  • SUSE Linux Enterprise Server
  • CentOS
  • Oracle Linux

Scores

Severity
critical
CVSS v2
9
CVSS v3
7.1
CVSS v4
—
EPSS
—

kernel s390 slab UAF critical mainframe patch defense

← All CVEs

Related CVEs

critical

CVE-2026-97995

CVE-2026-97995 is a Linux kernel memory-safety flaw in the virtio_console driver. During device removal, leftover control-out virtqueue cookies can be misinterpreted as port buffers, causing an out-of-bounds read of the ports_device object. It matters because virtio-console is used in virtualized Linux environments and the bug can be triggered during device unbind.

View analysis

critical

CVE-2026-98115

The Linux kernel ksmbd component had a critical flaw that allowed session teardown during SMB3 multichannel logoff to leave requests running on multiple connections, potentially causing resource leaks and denial of service. The patch ensures proper draining of sessions and cancellation callbacks. This affects any system running the kernel with ksmbd enabled.

View analysis

critical

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

View analysis

critical

CVE-2026-95832

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle_remote_ssh() in kitty/window.py, which writes the bytes yielded by get_ssh_data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The reply is framed as an OSC sequence carrying the escape code number, the field name, and the literal value ?. This results in execution of an attacker-chosen command with the privileges of the user running the terminal.

View analysis