CVE-2026-98649

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98649", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.362Z", "datePublished": "2026-10-18T15:20:21.346Z", "dateUpdated": "2026-10-19T09:23:18.799Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:18.799Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix race in _destroy_pages_crste()\n\nUse READ_ONCE() in _destroy_pages_crste() to read the crste, avoid\ndereferencing the pointer multiple times."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kvm/gmap/gmap.c"], "versions": [{"version": "a2c17f9270cc3f1c55c35e8b1d151f41d75b40f5", "lessThan": "90bd832b2bc367991d424d847003ce345b454ffc", "status": "affected", "versionType": "git"}, {"version": "a2c17f9270cc3f1c55c35e8b1d151f41d75b40f5", "lessThan": "4ca00a9154f998116fba9a32cce5bd938d228065", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kvm/gmap/gmap.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/90bd832b2bc367991d424d847003ce345b454ffc"}, {"url": "https://git.kernel.org/stable/c/4ca00a9154f998116fba9a32cce5bd938d228065"}], "title": "KVM: s390: Fix race in _destroy_pages_crste()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/s390/kvm/gmap/gmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "90bd832b2bc367991d424d847003ce345b454ffc", "status": "affected", "version": "a2c17f9270cc3f1c55c35e8b1d151f41d75b40f5", "versionType": "git"}, {"lessThan": "4ca00a9154f998116fba9a32cce5bd938d228065", "status": "affected", "version": "a2c17f9270cc3f1c55c35e8b1d151f41d75b40f5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/s390/kvm/gmap/gmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix race in _destroy_pages_crste()\n\nUse READ_ONCE() in _destroy_pages_crste() to read the crste, avoid\ndereferencing the pointer multiple times."}], "id": "CVE-2026-98649", "lastModified": "2026-10-19T10:19:29.353", "metrics": {}, "published": "2026-10-18T16:17:18.193", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ca00a9154f998116fba9a32cce5bd938d228065"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90bd832b2bc367991d424d847003ce345b454ffc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: s390: Fix race in _destroy_pages_crste()", "id": "2554937", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554937"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: s390: Fix race in _destroy_pages_crste()\nUse READ_ONCE() in _destroy_pages_crste() to read the crste, avoid\ndereferencing the pointer multiple times.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on s390 architectures. A local attacker can exploit this vulnerability to cause a Denial of Service (DoS) or memory corruption by triggering a race condition during guest memory page destruction. This issue occurs because memory management table entries are read multiple times concurrently without proper synchronization, allowing values to change between validation and use."], "name": "CVE-2026-98649", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98649\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98649\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98649.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2c17f9270cc3f1c55c35e8b1d151f41d75b40f5,90bd832b2bc367991d424d847003ce345b454ffc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2c17f9270cc3f1c55c35e8b1d151f41d75b40f5,4ca00a9154f998116fba9a32cce5bd938d228065)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T19:15:14.232804+00:00", "updated": "2026-10-23T07:30:09.337490+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}