Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-97593

iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX get_rso_from_iova() returns NULL when the region-first entry is invalid. Yet in get_rto_from_iova() the region-second origin rso is not checked to be non-NULL before accessing rso[rsx] leading to a NULL pointer dereference instead of a NULL return when iova_to_phys() is called on a unmapped IOVA. Fix this by adding the missing NULL check.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 81244074b518aeb90de5f68e7e825564c29c5c50 to < d0502ed0a1aae97e2ab7a21545903ba612d9f02eaffected
  • 81244074b518aeb90de5f68e7e825564c29c5c50 to < 41b5e0ce6801bf04d8fd3bca46e8c393349ebd5caffected
  • 81244074b518aeb90de5f68e7e825564c29c5c50 to < 20db6573301e66cd65ebf6c130b6563c69374d9daffected

Linux Linux

Default version status: affected

  • 6.16affected
  • 0 to < 6.16unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References