CVE-2026-98024

A MODERATE severity flaw was found in the Linux kernel s390 Internal Shared Memory (ISM) driver, used on s390x (IBM Z) systems. In the error exit path of ism_alloc_dmb(), memory that was allocated with folio_alloc() is incorrectly freed with kfree() instead of folio_put(), which corrupts kernel slab allocator state. A local user with low privileges who can exercise ISM-related operations can trigger this mismatched free only when a later step of a direct memory buffer (DMB) allocation fails after the folio has been allocated, resulting in slab memory corruption that can crash the kernel and cause a local denial of service. Red Hat rates this flaw CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (5.5, Moderate): exploitation requires local access and low privileges, and depends on error conditions in the allocation path that are not fully under the attacker's control; confidentiality and integrity are not impacted. Older Red Hat Enterprise Linux streams (RHEL 6, RHEL 7, and RHEL 8, including their kernel-rt builds, and the RHEL 9.2.0.z and RHEL 9.4.z streams) as well as earlier OpenShift Container Platform releases (up to and including 4.18) are marked Not Affected because the vulnerable code is not present in those kernels. The kernel in current RHEL 9 and RHEL 10 streams, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.19 and later (including 5.x releases shipping an affected RHEL 9 based CoreOS kernel) is affected. For these affected products the fix is currently deferred: given the low practical exploitability (local attack vector, high attack complexity, and the need for s390 ISM hardware) and an impact limited to availability, the fix does not warrant an out-of-band update and will be delivered in a future planned kernel update. The residual risk on affected s390x systems using ISM devices is a local denial of service (system crash).