Linux Kernel CVE-2026-45981

The affected code resides in drivers/s390/cio/css.c, specifically the css_alloc_subchannel() function within the IBM Z Channel Subsystem (CSS) driver, which manages I/O channel paths on s390/IBM Z mainframe hardware. The Linux device model requires that once device_initialize() is called on an embedded struct device, the containing structure must be released via put_device() to trigger the registered release callback that safely frees the container. The flawed error path instead calls kfree() directly on the subchannel structure after DMA mask setup (dma_set_coherent_mask() or dma_set_mask()) returns an error, which orphans the still-live reference count and risks use-after-free (if a concurrent reference exists) or double-free (if the release callback is later invoked). CWE-401 (Missing Release of Memory before Removing Last Reference) classifies this root cause: the reference lifetime is violated because the subsystem assumes exclusive ownership of the object after device_initialize(), which is incorrect. CPE data confirms the affected product as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, spanning multiple stable branches from the introducing commit e5dcf0025d7af58f525590ac86ac27cb44714e8d onward.