Skip to main content

Linux CVE-2026-98476

| EUVDEUVD-2026-103716
2026-10-18 Linux GHSA-cfjv-hvgg-mwp9
View
Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()

The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid_to_chp() can return NULL, leading to a NULL pointer dereference.

Add the missing NULL check before dereferencing the returned pointer.

Affected VersionsENISA

Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <dbf30e661ceb9a52c94c85719716391dcc29142a
Linux patch: 6.12.112
Linux patch: 7.3-rc5
Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <c3bbcb32deecc06ebb1762398399b566d5ff2fc9
Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <9d8b21820caed9128945fffcedf03e2a4c21eee2
Linux patch: 6.6.158
Linux patch: 6.18.55
Linux patch: 6.1.189
Linux patch: 5.10.271
Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <5fc54e04dad90b15d0430118b3f288a1d64e66c9
Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <5b76268dac968612f7283d59b539036de955b7d9
Linux patch: 5.15.222
Linux patch: 7.2.9
Linux patch: 0
Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <27e396a89f76f742abdbe9f8c4a58a6e806fdf59
Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <44b16b02608058fc72198ac0205969f0f43065df
Linux 4.18
Linux 199652309a4d6635fca19d7528d73ab9e219bd9a <5e006ac90a4d331db1dd712b91fec849b45ffc01

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Lifecycle Timeline

2
Patch available
Oct 18, 2026 - 16:02 EUVD
CVE Published
Oct 18, 2026 - 15:15 cve.org
UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Data Quality
3 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity Not scored yet
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
No CVSS yet + weak signal (CWE or non-zero EPSS)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy