{"schema":"threatline.record/2","record":{"id":"CVE-2026-98400","aliases":[],"summary":"s390/ipl: Fix NULL deref in kdump without re-IPL parm block","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ipl: Fix NULL deref in kdump without re-IPL parm block\n\nSome IPL types, like HMC FTP boot or QEMU direct kernel boot, might\nnot provide an IPL parameter block. In this case, reipl_type_init()\nselects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.\n\nkdump passes the re-IPL parameter block to the dump kernel through\nos_info. Before commit 3b9678472bab (\"s390/ipl: correct kdump reipl\nblock checksum calculation\"), the os_info entry was added only for\nIPL types which initialized reipl_block_actual. That commit moved the\nos_info update to machine_crash_shutdown(), making it unconditional. As\na result, set_os_info_reipl_block() dereferences reipl_block_actual for\nIPL_TYPE_UNKNOWN. This may happen to work by chance when address zero\ncontains readable lowcore data and the resulting empty os_info entry is\nignored by the dump kernel.\n\nSkip the os_info update when no re-IPL parameter block is available.\nKdump then collect the dump and reboot without setting re-IPL parameter\nblock.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_modified_at":"2026-10-19T09:18:53.762Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"3b9678472bab86ae654cf2c18d5dd551558045be","lessThan":"030e88812435fc5d6aa42eee41fa77b5ea620327","status":"affected","versionType":"git"},{"version":"3b9678472bab86ae654cf2c18d5dd551558045be","lessThan":"92d0829eae257544b6b0faccb6e7079c45e22d48","status":"affected","versionType":"git"},{"version":"3b9678472bab86ae654cf2c18d5dd551558045be","lessThan":"50f9c40768e84f30d374235b3ee3850a94d9ac29","status":"affected","versionType":"git"},{"version":"3b9678472bab86ae654cf2c18d5dd551558045be","lessThan":"b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd","status":"affected","versionType":"git"},{"version":"3b9678472bab86ae654cf2c18d5dd551558045be","lessThan":"7f918871112e8e7c581e99eb8e545af4e59c8367","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_modified_at":"2026-10-19T09:18:53.762Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_modified_at":"2026-10-19T09:18:53.762Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"030e88812435fc5d6aa42eee41fa77b5ea620327","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_modified_at":"2026-10-19T09:18:53.762Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"92d0829eae257544b6b0faccb6e7079c45e22d48","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_modified_at":"2026-10-19T09:18:53.762Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"50f9c40768e84f30d374235b3ee3850a94d9ac29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","source_modified_at":"2026-10-19T09:18:53.762Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"7f918871112e8e7c581e99eb8e545af4e59c8367","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00209,"percentile":0.10537,"score_date":"2026-10-23"},"published_at":"2026-10-14T13:26:00.872Z","modified_at":"2026-10-19T09:18:53.762Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98400","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:18:53.762Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98400","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/030e88812435fc5d6aa42eee41fa77b5ea620327"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/92d0829eae257544b6b0faccb6e7079c45e22d48"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/50f9c40768e84f30d374235b3ee3850a94d9ac29"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:18:53.762Z","content_hash":"152c396c7b5afccd3c83a7d069d652fc9505b36f43879254bc25f31f3f61f76b"}}