CVE-2026-98475

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98475", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.351Z", "datePublished": "2026-10-18T15:15:44.206Z", "dateUpdated": "2026-10-19T09:20:12.941Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:12.941Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cmf: Fix virtual vs physical address confusion\n\nThe measurement block address is an absolute address. Define the\nassociated schib_config and schib fields as dma64_t to enable automatic\ndetection of incorrect assignments. Also add the missing virt_to_dma64()\ntranslation.\n\nWithout this fix, a wrong address will be used by firmware when storing\nextended format channel measurement data on kernels built with\nCONFIG_RANDOMIZE_IDENTITY_BASE=y."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/cio/cio.h", "drivers/s390/cio/cmf.c"], "versions": [{"version": "14edd0d73bfef320fd5be11495687ba537aa6341", "lessThan": "b11f369be31ea11c746833e4d3ad51dcd6b5fa2b", "status": "affected", "versionType": "git"}, {"version": "14edd0d73bfef320fd5be11495687ba537aa6341", "lessThan": "748ec2f7f5df9b4fc742546a8bfc8aa5d847353e", "status": "affected", "versionType": "git"}, {"version": "14edd0d73bfef320fd5be11495687ba537aa6341", "lessThan": "7f78226eb743b362f52b212d7763801642539d1c", "status": "affected", "versionType": "git"}, {"version": "14edd0d73bfef320fd5be11495687ba537aa6341", "lessThan": "f4d04425e66af2ecee9d1a49ae0484436f3c2fd1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/cio/cio.h", "drivers/s390/cio/cmf.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b11f369be31ea11c746833e4d3ad51dcd6b5fa2b"}, {"url": "https://git.kernel.org/stable/c/748ec2f7f5df9b4fc742546a8bfc8aa5d847353e"}, {"url": "https://git.kernel.org/stable/c/7f78226eb743b362f52b212d7763801642539d1c"}, {"url": "https://git.kernel.org/stable/c/f4d04425e66af2ecee9d1a49ae0484436f3c2fd1"}], "title": "s390/cmf: Fix virtual vs physical address confusion", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/s390/cio/cio.h", "drivers/s390/cio/cmf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b11f369be31ea11c746833e4d3ad51dcd6b5fa2b", "status": "affected", "version": "14edd0d73bfef320fd5be11495687ba537aa6341", "versionType": "git"}, {"lessThan": "748ec2f7f5df9b4fc742546a8bfc8aa5d847353e", "status": "affected", "version": "14edd0d73bfef320fd5be11495687ba537aa6341", "versionType": "git"}, {"lessThan": "7f78226eb743b362f52b212d7763801642539d1c", "status": "affected", "version": "14edd0d73bfef320fd5be11495687ba537aa6341", "versionType": "git"}, {"lessThan": "f4d04425e66af2ecee9d1a49ae0484436f3c2fd1", "status": "affected", "version": "14edd0d73bfef320fd5be11495687ba537aa6341", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/s390/cio/cio.h", "drivers/s390/cio/cmf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cmf: Fix virtual vs physical address confusion\n\nThe measurement block address is an absolute address. Define the\nassociated schib_config and schib fields as dma64_t to enable automatic\ndetection of incorrect assignments. Also add the missing virt_to_dma64()\ntranslation.\n\nWithout this fix, a wrong address will be used by firmware when storing\nextended format channel measurement data on kernels built with\nCONFIG_RANDOMIZE_IDENTITY_BASE=y."}], "id": "CVE-2026-98475", "lastModified": "2026-10-19T10:18:58.150", "metrics": {}, "published": "2026-10-18T16:16:58.027", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/748ec2f7f5df9b4fc742546a8bfc8aa5d847353e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f78226eb743b362f52b212d7763801642539d1c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b11f369be31ea11c746833e4d3ad51dcd6b5fa2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f4d04425e66af2ecee9d1a49ae0484436f3c2fd1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/cmf: Fix virtual vs physical address confusion", "id": "2554893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554893"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/cmf: Fix virtual vs physical address confusion\nThe measurement block address is an absolute address. Define the\nassociated schib_config and schib fields as dma64_t to enable automatic\ndetection of incorrect assignments. Also add the missing virt_to_dma64()\ntranslation.\nWithout this fix, a wrong address will be used by firmware when storing\nextended format channel measurement data on kernels built with\nCONFIG_RANDOMIZE_IDENTITY_BASE=y.", "A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresses. When extended format channel measurement data is recorded on systems using randomized memory configurations, the kernel fails to properly translate the target memory address before providing it to the system firmware. Consequently, the firmware writes measurement data into unintended physical memory locations, which can destabilize the system or result in a crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98475", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98475\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98475\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98475.mbox"], "statement": "An address space confusion in s390 channel measurement handling can pass a virtual measurement block address to firmware as an absolute DMA address. On kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE, firmware may therefore store extended channel measurement data at an unintended physical address. Depending on firmware address validation and the resulting location, this may cause measurement failure, corruption of unrelated physical memory, a kernel crash, or loss of system availability. The issue is local, specific to affected s390 configurations, and is not directly network reachable. For the CVSS the PR:H is selected because activating or configuring channel measurement blocks normally requires administrative control over the channel subsystem. The base score represents limited integrity impact and high availability impact from a wrong firmware write. The paranoid score treats the unintended physical memory write as a potential strong kernel memory corruption primitive, although reliable attacker control over the destination and contents is not established.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[14edd0d73bfef320fd5be11495687ba537aa6341,b11f369be31ea11c746833e4d3ad51dcd6b5fa2b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[14edd0d73bfef320fd5be11495687ba537aa6341,748ec2f7f5df9b4fc742546a8bfc8aa5d847353e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[14edd0d73bfef320fd5be11495687ba537aa6341,7f78226eb743b362f52b212d7763801642539d1c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[14edd0d73bfef320fd5be11495687ba537aa6341,f4d04425e66af2ecee9d1a49ae0484436f3c2fd1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T16:45:17.334117+00:00", "updated": "2026-10-20T20:45:14.327726+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-20", "CWE-787"]}