{
  "cveId": "CVE-2026-98474",
  "url": "https://patchblox.com/security/cve/CVE-2026-98474",
  "summary": "CVE-2026-98474 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98474 (version 7.2.9-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "s390/pci: Fix missing device lock in zpci_report_status()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  s390/pci: Fix missing device lock in zpci_report_status()  When pdev is non-NULL, zpci_report_status() accesses the device\u0027s driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the existing device lock critical section.  The lock only needs to be held when the pdev is non-NULL, so extract the pdev-specific reporting into a helper function which also adds a lockdep assertion to detect calls without the device lock held.",
  "published": "2026-10-18T16:16:57Z",
  "severity": "",
  "epss": 0.00166,
  "epssPercentile": 0.05891,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98474",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.9-1",
      "fix": "DEBIAN-CVE-2026-98474",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98474",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}