Linux Kernel CVE-2026-45981

Exploitation requires local authenticated access (CVSS PR:L) on a physical or virtualized IBM Z (s390 architecture) system - this vulnerability does not affect x86, ARM, or any other architecture. The flaw is triggered specifically when dma_set_coherent_mask() or dma_set_mask() returns an error during css_alloc_subchannel(), a condition tied to DMA mask incompatibility during channel subsystem device enumeration or hotplug. Exploitation is further limited by the need to time a concurrent kernel reference to the freed structure (for use-after-free) or to trigger the release callback after the direct free (for double-free). Factors limiting exploitation: s390-only hardware constraint eliminates the vast majority of Linux deployments; error condition is hardware-triggered rather than directly user-controllable; low-privilege local access is still required (not exploitable remotely); and the EPSS of 0.02% confirms negligible threat-actor interest. Systems running Linux exclusively on x86/ARM infrastructure are entirely unaffected.

Real-world risk is constrained by several factors that collectively make this a low-priority finding for most organizations. The CVSS vector AV:L/AC:L/PR:L demands local authenticated access on s390 (IBM Z) architecture hardware - a rare deployment context already limiting the exposed population. EPSS at 0.02% (7th percentile) reflects near-zero observed exploitation interest across the threat intelligence community. The vulnerability is not listed in CISA KEV, and no public exploit code exists. The impact is limited to kernel availability (A:H); confidentiality and integrity are unaffected (C:N/I:N). One notable tension: the NVD vector assigns AC:L, implying the error condition is reliably triggerable, but the actual trigger - a failure in DMA mask configuration during channel subsystem initialization - is dependent on specific hardware-level conditions that a low-privilege local user may not be able to force deterministically, suggesting AC:H may more accurately reflect realistic exploitation complexity. The 'Authentication Bypass' tag in the source data appears to be a mislabeling artifact - the description contains no mechanism for authentication bypass. Net assessment: upgrade s390 kernel deployments as part of routine patching; no emergency action warranted.

A local user on an IBM Z system running a vulnerable kernel version observes or induces a DMA mask configuration failure during CSS subchannel allocation - for example, during hotplug of a channel path device where the underlying hardware reports an incompatible DMA mask. The kernel's css_alloc_subchannel() then calls kfree() on the subchannel structure while a live device reference still exists, corrupting kernel heap state and triggering a kernel panic or potential code execution in a concurrent kernel thread holding the stale reference. No public proof-of-concept exploit exists at the time of analysis.