CVE-2026-98648

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98648", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.362Z", "datePublished": "2026-10-18T15:20:20.496Z", "dateUpdated": "2026-10-19T09:23:17.853Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:17.853Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/uv: Prevent potential out-of-bounds read\n\nWhen the system has more than 85 secrets, the uv_secret_list struct\narray only holds up to 85 items per page, resulting in an out of bounds\nread in find_secret_in_page if the targeted secret is in the next page\nor not stored at all.\n\nFix this by looping over the number of stored secrets which is the\nper sub-list count of stored secrets and not the overall count."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kernel/uv.c"], "versions": [{"version": "7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d", "lessThan": "04bb5b2eb9f1d56110f14d3a4e31fa2c65fb026f", "status": "affected", "versionType": "git"}, {"version": "7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d", "lessThan": "116bba758533a139bbede8d717a1371bd6d890f6", "status": "affected", "versionType": "git"}, {"version": "7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d", "lessThan": "f47190b08b71e8482072978373ee88cb2dfbdaf4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kernel/uv.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/04bb5b2eb9f1d56110f14d3a4e31fa2c65fb026f"}, {"url": "https://git.kernel.org/stable/c/116bba758533a139bbede8d717a1371bd6d890f6"}, {"url": "https://git.kernel.org/stable/c/f47190b08b71e8482072978373ee88cb2dfbdaf4"}], "title": "s390/uv: Prevent potential out-of-bounds read", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/s390/kernel/uv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "04bb5b2eb9f1d56110f14d3a4e31fa2c65fb026f", "status": "affected", "version": "7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d", "versionType": "git"}, {"lessThan": "116bba758533a139bbede8d717a1371bd6d890f6", "status": "affected", "version": "7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d", "versionType": "git"}, {"lessThan": "f47190b08b71e8482072978373ee88cb2dfbdaf4", "status": "affected", "version": "7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/s390/kernel/uv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/uv: Prevent potential out-of-bounds read\n\nWhen the system has more than 85 secrets, the uv_secret_list struct\narray only holds up to 85 items per page, resulting in an out of bounds\nread in find_secret_in_page if the targeted secret is in the next page\nor not stored at all.\n\nFix this by looping over the number of stored secrets which is the\nper sub-list count of stored secrets and not the overall count."}], "id": "CVE-2026-98648", "lastModified": "2026-10-19T10:19:29.240", "metrics": {}, "published": "2026-10-18T16:17:18.097", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/04bb5b2eb9f1d56110f14d3a4e31fa2c65fb026f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/116bba758533a139bbede8d717a1371bd6d890f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f47190b08b71e8482072978373ee88cb2dfbdaf4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/uv: Prevent potential out-of-bounds read", "id": "2555023", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555023"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/uv: Prevent potential out-of-bounds read\nWhen the system has more than 85 secrets, the uv_secret_list struct\narray only holds up to 85 items per page, resulting in an out of bounds\nread in find_secret_in_page if the targeted secret is in the next page\nor not stored at all.\nFix this by looping over the number of stored secrets which is the\nper sub-list count of stored secrets and not the overall count.", "A flaw was found in the Linux kernel's IBM s390 Ultravisor subsystem. When searching stored secrets on systems holding more than 85 secrets, the kernel incorrectly references the total secret count instead of the number of items stored in the current memory page. A local user can exploit this vulnerability to trigger an out-of-bounds memory read, potentially leading to a Denial of Service (DoS) through a system crash or the disclosure of sensitive kernel memory."], "name": "CVE-2026-98648", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98648\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98648\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98648.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d,04bb5b2eb9f1d56110f14d3a4e31fa2c65fb026f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d,116bba758533a139bbede8d717a1371bd6d890f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d,f47190b08b71e8482072978373ee88cb2dfbdaf4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T19:15:14.232949+00:00", "updated": "2026-10-23T06:45:07.463372+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}