---
id: CVE-2026-45981
title: 's390/cio: Fix device lifecycle handling in css_alloc_subchannel()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/cio: Fix device lifecycle handling in css_alloc_subchannel()

  `css_alloc_subchannel()` calls `device_initialize()` before setting up
  the DMA masks. If `dma_set_coh…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d <
    abb6e07f46a740cda4f07d1b561ae4eaa7a1df42
  - >-
    Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d <
    f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424
  - >-
    Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d <
    6715560527e343a387e4a0d2e6c401748e89fa55
  - >-
    Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d <
    c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603
  - >-
    Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d <
    f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7
  - Linux 3.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:03:48.168902Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:29.775Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45981'
references:
  - url: 'https://git.kernel.org/stable/c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42'
  - url: 'https://git.kernel.org/stable/c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424'
  - url: 'https://git.kernel.org/stable/c/6715560527e343a387e4a0d2e6c401748e89fa55'
  - url: 'https://git.kernel.org/stable/c/c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603'
  - url: 'https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02329
ingestedAt: '2026-11-06T16:57:43.355Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/cio: Fix device lifecycle handling in css_alloc_subchannel()

`css_alloc_subchannel()` calls `device_initialize()` before setting up
the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails,
the error path frees the subchannel structure directly, bypassing
the device model reference counting.

Once `device_initialize()` has been called, the embedded struct device
must be released via `put_device()`, allowing the release callback to
free the container structure.

Fix the error path by dropping the initial device reference with
`put_device()` instead of calling `kfree()` directly.

This ensures correct device lifetime handling and avoids potential
use-after-free or double-free issues.

## Affected

- `Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d < abb6e07f46a740cda4f07d1b561ae4eaa7a1df42`
- `Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d < f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424`
- `Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d < 6715560527e343a387e4a0d2e6c401748e89fa55`
- `Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d < c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603`
- `Linux >= e5dcf0025d7af58f525590ac86ac27cb44714e8d < f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.