All vulnerabilities
CVE-2026-99126

Linux: s390/ctcm: Prevent XID null dereference

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in34fa3607b7604b3052b19cec8b0ad644818cdd2aAlso 8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeabCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 34fa3607b7604b3052b19cec8b0ad644818cdd2aLinuxCVE List
  • 8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeabLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/ctcm: Prevent XID null dereference

The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->saved_xid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference.

Fix this by using the always available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 for validation errors.

Text from CVE List

Affected versions 8

  • Linuxaffected: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 before 34fa3607b7604b3052b19cec8b0ad644818cdd2aCVE List
  • Linuxaffected: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 before 8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeabCVE List
  • Linuxaffected: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 before b264d8422779d69febce914efc47a92a85cc382cCVE List
  • Linuxaffected: 2.6.26CVE List
  • Linuxunaffected: all versions before 2.6.26CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3