SB2026102246 - Race condition in Linux kernel s390 pci

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98474)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent PCI device status reporting through a race condition.

The vulnerability exists due to missing synchronization in the Linux kernel s390 PCI function zpci_report_status() when accessing device and driver state during recovery reporting. A local user can potentially exercise this reporting path concurrently with device or driver state changes to produce status reports that do not consistently reflect the recovery state.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0261aef4b15efcee2860ab857e5cb05e9bfa47b0
• https://git.kernel.org/stable/c/1b957d5c2f737cda731cb1a1b71a7524d54538f2
• https://git.kernel.org/stable/c/743a8458978d13d84a1cf74bcd29b9959a75d3a0