Race condition in Linux kernel - CVE-2026-98474

Vulnerability identifier: #VU156774

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98474

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause inconsistent PCI device status reporting through a race condition.

The vulnerability exists due to missing synchronization in the Linux kernel s390 PCI function zpci_report_status() when accessing device and driver state during recovery reporting. A local user can potentially exercise this reporting path concurrently with device or driver state changes to produce status reports that do not consistently reflect the recovery state.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0261aef4b15efcee2860ab857e5cb05e9bfa47b0
• https://git.kernel.org/stable/c/1b957d5c2f737cda731cb1a1b71a7524d54538f2
• https://git.kernel.org/stable/c/743a8458978d13d84a1cf74bcd29b9959a75d3a0

• Race condition in Linux kernel s390 pci
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more