---
id: CVE-2026-98476
title: 's390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()

  The channel path registry entry associated with a CHPID may be removed
  while the subchannel's PMCW …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    9d8b21820caed9128945fffcedf03e2a4c21eee2
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    5fc54e04dad90b15d0430118b3f288a1d64e66c9
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    27e396a89f76f742abdbe9f8c4a58a6e806fdf59
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    dbf30e661ceb9a52c94c85719716391dcc29142a
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    5e006ac90a4d331db1dd712b91fec849b45ffc01
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    c3bbcb32deecc06ebb1762398399b566d5ff2fc9
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    44b16b02608058fc72198ac0205969f0f43065df
  - >-
    Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a <
    5b76268dac968612f7283d59b539036de955b7d9
  - Linux 4.18
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:45.100Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98476'
references:
  - url: 'https://git.kernel.org/stable/c/9d8b21820caed9128945fffcedf03e2a4c21eee2'
  - url: 'https://git.kernel.org/stable/c/5fc54e04dad90b15d0430118b3f288a1d64e66c9'
  - url: 'https://git.kernel.org/stable/c/27e396a89f76f742abdbe9f8c4a58a6e806fdf59'
  - url: 'https://git.kernel.org/stable/c/dbf30e661ceb9a52c94c85719716391dcc29142a'
  - url: 'https://git.kernel.org/stable/c/5e006ac90a4d331db1dd712b91fec849b45ffc01'
  - url: 'https://git.kernel.org/stable/c/c3bbcb32deecc06ebb1762398399b566d5ff2fc9'
  - url: 'https://git.kernel.org/stable/c/44b16b02608058fc72198ac0205969f0f43065df'
  - url: 'https://git.kernel.org/stable/c/5b76268dac968612f7283d59b539036de955b7d9'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.298Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()

The channel path registry entry associated with a CHPID may be removed
while the subchannel's PMCW still references that CHPID. In this case,
chpid_to_chp() can return NULL, leading to a NULL pointer dereference.

Add the missing NULL check before dereferencing the returned pointer.

## Affected

- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < 9d8b21820caed9128945fffcedf03e2a4c21eee2`
- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < 5fc54e04dad90b15d0430118b3f288a1d64e66c9`
- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < 27e396a89f76f742abdbe9f8c4a58a6e806fdf59`
- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < dbf30e661ceb9a52c94c85719716391dcc29142a`
- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < 5e006ac90a4d331db1dd712b91fec849b45ffc01`
- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < c3bbcb32deecc06ebb1762398399b566d5ff2fc9`
- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < 44b16b02608058fc72198ac0205969f0f43065df`
- `Linux >= 199652309a4d6635fca19d7528d73ab9e219bd9a < 5b76268dac968612f7283d59b539036de955b7d9`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.