CVE-2026-98400

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98400", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.346Z", "datePublished": "2026-10-14T13:26:00.872Z", "dateUpdated": "2026-10-19T09:18:53.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:18:53.762Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ipl: Fix NULL deref in kdump without re-IPL parm block\n\nSome IPL types, like HMC FTP boot or QEMU direct kernel boot, might\nnot provide an IPL parameter block. In this case, reipl_type_init()\nselects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.\n\nkdump passes the re-IPL parameter block to the dump kernel through\nos_info. Before commit 3b9678472bab (\"s390/ipl: correct kdump reipl\nblock checksum calculation\"), the os_info entry was added only for\nIPL types which initialized reipl_block_actual. That commit moved the\nos_info update to machine_crash_shutdown(), making it unconditional. As\na result, set_os_info_reipl_block() dereferences reipl_block_actual for\nIPL_TYPE_UNKNOWN. This may happen to work by chance when address zero\ncontains readable lowcore data and the resulting empty os_info entry is\nignored by the dump kernel.\n\nSkip the os_info update when no re-IPL parameter block is available.\nKdump then collect the dump and reboot without setting re-IPL parameter\nblock."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kernel/ipl.c"], "versions": [{"version": "3b9678472bab86ae654cf2c18d5dd551558045be", "lessThan": "030e88812435fc5d6aa42eee41fa77b5ea620327", "status": "affected", "versionType": "git"}, {"version": "3b9678472bab86ae654cf2c18d5dd551558045be", "lessThan": "92d0829eae257544b6b0faccb6e7079c45e22d48", "status": "affected", "versionType": "git"}, {"version": "3b9678472bab86ae654cf2c18d5dd551558045be", "lessThan": "50f9c40768e84f30d374235b3ee3850a94d9ac29", "status": "affected", "versionType": "git"}, {"version": "3b9678472bab86ae654cf2c18d5dd551558045be", "lessThan": "b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd", "status": "affected", "versionType": "git"}, {"version": "3b9678472bab86ae654cf2c18d5dd551558045be", "lessThan": "7f918871112e8e7c581e99eb8e545af4e59c8367", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kernel/ipl.c"], "versions": [{"version": "4.17", "status": "affected"}, {"version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/030e88812435fc5d6aa42eee41fa77b5ea620327"}, {"url": "https://git.kernel.org/stable/c/92d0829eae257544b6b0faccb6e7079c45e22d48"}, {"url": "https://git.kernel.org/stable/c/50f9c40768e84f30d374235b3ee3850a94d9ac29"}, {"url": "https://git.kernel.org/stable/c/b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd"}, {"url": "https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}], "title": "s390/ipl: Fix NULL deref in kdump without re-IPL parm block", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/s390/kernel/ipl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "030e88812435fc5d6aa42eee41fa77b5ea620327", "status": "affected", "version": "3b9678472bab86ae654cf2c18d5dd551558045be", "versionType": "git"}, {"lessThan": "92d0829eae257544b6b0faccb6e7079c45e22d48", "status": "affected", "version": "3b9678472bab86ae654cf2c18d5dd551558045be", "versionType": "git"}, {"lessThan": "50f9c40768e84f30d374235b3ee3850a94d9ac29", "status": "affected", "version": "3b9678472bab86ae654cf2c18d5dd551558045be", "versionType": "git"}, {"lessThan": "b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd", "status": "affected", "version": "3b9678472bab86ae654cf2c18d5dd551558045be", "versionType": "git"}, {"lessThan": "7f918871112e8e7c581e99eb8e545af4e59c8367", "status": "affected", "version": "3b9678472bab86ae654cf2c18d5dd551558045be", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/s390/kernel/ipl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"lessThan": "4.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ipl: Fix NULL deref in kdump without re-IPL parm block\n\nSome IPL types, like HMC FTP boot or QEMU direct kernel boot, might\nnot provide an IPL parameter block. In this case, reipl_type_init()\nselects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.\n\nkdump passes the re-IPL parameter block to the dump kernel through\nos_info. Before commit 3b9678472bab (\"s390/ipl: correct kdump reipl\nblock checksum calculation\"), the os_info entry was added only for\nIPL types which initialized reipl_block_actual. That commit moved the\nos_info update to machine_crash_shutdown(), making it unconditional. As\na result, set_os_info_reipl_block() dereferences reipl_block_actual for\nIPL_TYPE_UNKNOWN. This may happen to work by chance when address zero\ncontains readable lowcore data and the resulting empty os_info entry is\nignored by the dump kernel.\n\nSkip the os_info update when no re-IPL parameter block is available.\nKdump then collect the dump and reboot without setting re-IPL parameter\nblock."}], "id": "CVE-2026-98400", "lastModified": "2026-10-19T10:18:44.820", "metrics": {}, "published": "2026-10-14T14:17:51.010", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/030e88812435fc5d6aa42eee41fa77b5ea620327"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/50f9c40768e84f30d374235b3ee3850a94d9ac29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/92d0829eae257544b6b0faccb6e7079c45e22d48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/ipl: Fix NULL deref in kdump without re-IPL parm block", "id": "2552215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552215"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/ipl: Fix NULL deref in kdump without re-IPL parm block\nSome IPL types, like HMC FTP boot or QEMU direct kernel boot, might\nnot provide an IPL parameter block. In this case, reipl_type_init()\nselects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.\nkdump passes the re-IPL parameter block to the dump kernel through\nos_info. Before commit 3b9678472bab (\"s390/ipl: correct kdump reipl\nblock checksum calculation\"), the os_info entry was added only for\nIPL types which initialized reipl_block_actual. That commit moved the\nos_info update to machine_crash_shutdown(), making it unconditional. As\na result, set_os_info_reipl_block() dereferences reipl_block_actual for\nIPL_TYPE_UNKNOWN. This may happen to work by chance when address zero\ncontains readable lowcore data and the resulting empty os_info entry is\nignored by the dump kernel.\nSkip the os_info update when no re-IPL parameter block is available.\nKdump then collect the dump and reboot without setting re-IPL parameter\nblock.", "A flaw was found in the Linux kernel's s390 architecture. On systems booted without an Initial Program Load (IPL) parameter block, such as direct virtual machine boots, the kernel crash shutdown handler unconditionally dereferences an uninitialized pointer when preparing crash data. If a crash occurs, this null pointer dereference disrupts the crash dump process and prevents the system from rebooting properly, resulting in a denial of service (DoS)."], "name": "CVE-2026-98400", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98400\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98400\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98400.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b9678472bab86ae654cf2c18d5dd551558045be,030e88812435fc5d6aa42eee41fa77b5ea620327)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b9678472bab86ae654cf2c18d5dd551558045be,92d0829eae257544b6b0faccb6e7079c45e22d48)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b9678472bab86ae654cf2c18d5dd551558045be,50f9c40768e84f30d374235b3ee3850a94d9ac29)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b9678472bab86ae654cf2c18d5dd551558045be,b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b9678472bab86ae654cf2c18d5dd551558045be,7f918871112e8e7c581e99eb8e545af4e59c8367)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-15T03:45:12.188616+00:00", "updated": "2026-10-19T19:00:04.689505+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}