CVE-2026-98474
In the Linux kernel, the following vulnerability has been resolved:
s390/pci: Fix missing device lock in zpci_report_status()
When pdev is non-NULL, zpci_report_status() accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the existing device lock critical section.
The lock only needs to be held when the pdev is non-NULL, so extract the pdev-specific reporting into a helper function which also adds a lockdep assertion to detect calls without the device lock held.
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.17 %
- Percentile among all scored CVEs
- 5
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98474",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6",
"lessThan": "743a8458978d13d84a1cf74bcd29b9959a75d3a0",
"versionType": "git"
},
{
"status": "affected",
"version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6",
"lessThan": "1b957d5c2f737cda731cb1a1b71a7524d54538f2",
"versionType": "git"
},
{
"status": "affected",
"version": "4ec6054e7321dc24ebccaa08b3af0d590f5666e6",
"lessThan": "0261aef4b15efcee2860ab857e5cb05e9bfa47b0",
"versionType": "git"
}
],
"programFiles": [
"arch/s390/pci/pci_event.c",
"arch/s390/pci/pci_report.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/s390/pci/pci_event.c",
"arch/s390/pci/pci_report.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:57.927",
"references": [
{
"url": "https://git.kernel.org/stable/c/0261aef4b15efcee2860ab857e5cb05e9bfa47b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1b957d5c2f737cda731cb1a1b71a7524d54538f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/743a8458978d13d84a1cf74bcd29b9959a75d3a0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Fix missing device lock in zpci_report_status()\n\nWhen pdev is non-NULL, zpci_report_status() accesses the device's driver.\nTo get a consistent state matching the recovery, the device lock needs to\nbe held. Do so by expanding the existing device lock critical section.\n\nThe lock only needs to be held when the pdev is non-NULL, so extract\nthe pdev-specific reporting into a helper function which also adds a\nlockdep assertion to detect calls without the device lock held."
}
],
"lastModified": "2026-10-19T10:18:58.000",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}