{"cve":"CVE-2026-98474","nvd":{"published":"2026-10-18T16:16:57.927","modified":"2026-10-19T10:18:58.000","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Fix missing device lock in zpci_report_status()\n\nWhen pdev is non-NULL, zpci_report_status() accesses the device's driver.\nTo get a consistent state matching the recovery, the device lock needs to\nbe held. Do so by expanding the existing device lock critical section.\n\nThe lock only needs to be held when the pdev is non-NULL, so extract\nthe pdev-specific reporting into a helper function which also adds a\nlockdep assertion to detect calls without the device lock held.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0261aef4b15efcee2860ab857e5cb05e9bfa47b0","https://git.kernel.org/stable/c/1b957d5c2f737cda731cb1a1b71a7524d54538f2","https://git.kernel.org/stable/c/743a8458978d13d84a1cf74bcd29b9959a75d3a0"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-98474","score":0.00166,"percentile":0.05795,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}