In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpci_report_status() When pdev is non-NULL,… (CVE-2026-98474)

The Linux kernel had a concurrency issue in the s390/pci code where zpci_report_status() accessed the device's driver without holding the necessary device lock when pdev was non-NULL. This could lead to inconsistent device states during recovery operations. The patch introduced a helper function to handle pdev-specific reporting while ensuring the device lock is held, along with lockdep assertions to detect improper calls without the lock.

Without the device lock held, concurrent access to the device driver state could cause inconsistent or unexpected behavior during device recovery. This may affect system stability or correctness on s390 architectures using PCI devices. No known exploits or CVSS score are reported, so the exact impact severity is not quantified.

An official fix has been applied to the Linux kernel source code to address this issue. Users should update to a kernel version that includes this patch to ensure the device lock is properly held during zpci_report_status() execution. No additional mitigation steps are indicated.