All vulnerabilities
CVE-2026-98400

Linux: s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in030e88812435fc5d6aa42eee41fa77b5ea620327Also 92d0829eae257544b6b0faccb6e7079c45e22d48, 50f9c40768e84f30d374235b3ee3850a94d9ac29 and 1 moreCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 030e88812435fc5d6aa42eee41fa77b5ea620327LinuxCVE List
  • 92d0829eae257544b6b0faccb6e7079c45e22d48LinuxCVE List
  • 50f9c40768e84f30d374235b3ee3850a94d9ac29LinuxCVE List
  • 7f918871112e8e7c581e99eb8e545af4e59c8367LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipl_type_init() selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.

kdump passes the re-IPL parameter block to the dump kernel through os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl block checksum calculation"), the os_info entry was added only for IPL types which initialized reipl_block_actual. That commit moved the os_info update to machine_crash_shutdown(), making it unconditional. As a result, set_os_info_reipl_block() dereferences reipl_block_actual for IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero contains readable lowcore data and the resulting empty os_info entry is ignored by the dump kernel.

Skip the os_info update when no re-IPL parameter block is available. Kdump then collect the dump and reboot without setting re-IPL parameter block.

Text from CVE List

Affected versions 12

  • Linuxaffected: 3b9678472bab86ae654cf2c18d5dd551558045be before 030e88812435fc5d6aa42eee41fa77b5ea620327CVE List
  • Linuxaffected: 3b9678472bab86ae654cf2c18d5dd551558045be before 92d0829eae257544b6b0faccb6e7079c45e22d48CVE List
  • Linuxaffected: 3b9678472bab86ae654cf2c18d5dd551558045be before 50f9c40768e84f30d374235b3ee3850a94d9ac29CVE List
  • Linuxaffected: 3b9678472bab86ae654cf2c18d5dd551558045be before b6bf82bc5e00afaf836f8bb9a676bffc182a6bbdCVE List
  • Linuxaffected: 3b9678472bab86ae654cf2c18d5dd551558045be before 7f918871112e8e7c581e99eb8e545af4e59c8367CVE List
  • Linuxaffected: 4.17CVE List
  • Linuxunaffected: all versions before 4.17CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5