CVE-2026-98400 is a vulnerability in Linux Kernel
Published on October 14, 2026
s390/ipl: Fix NULL deref in kdump without re-IPL parm block
In the Linux kernel, the following vulnerability has been resolved:
s390/ipl: Fix NULL deref in kdump without re-IPL parm block
Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might
not provide an IPL parameter block. In this case, reipl_type_init()
selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.
kdump passes the re-IPL parameter block to the dump kernel through
os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl
block checksum calculation"), the os_info entry was added only for
IPL types which initialized reipl_block_actual. That commit moved the
os_info update to machine_crash_shutdown(), making it unconditional. As
a result, set_os_info_reipl_block() dereferences reipl_block_actual for
IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero
contains readable lowcore data and the resulting empty os_info entry is
ignored by the dump kernel.
Skip the os_info update when no re-IPL parameter block is available.
Kdump then collect the dump and reboot without setting re-IPL parameter
block.
Products Associated with CVE-2026-98400
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 3b9678472bab86ae654cf2c18d5dd551558045be and below 030e88812435fc5d6aa42eee41fa77b5ea620327 is affected.
- Version 3b9678472bab86ae654cf2c18d5dd551558045be and below 92d0829eae257544b6b0faccb6e7079c45e22d48 is affected.
- Version 3b9678472bab86ae654cf2c18d5dd551558045be and below 50f9c40768e84f30d374235b3ee3850a94d9ac29 is affected.
- Version 3b9678472bab86ae654cf2c18d5dd551558045be and below b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd is affected.
- Version 3b9678472bab86ae654cf2c18d5dd551558045be and below 7f918871112e8e7c581e99eb8e545af4e59c8367 is affected.
- Version 4.17 is affected.
- Before 4.17 is unaffected.
- Version 6.6.158, <= 6.6.* is unaffected.
- Version 6.12.111, <= 6.12.* is unaffected.
- Version 6.18.53, <= 6.18.* is unaffected.
- Version 7.2.7, <= 7.2.* is unaffected.
- Version 7.3-rc2, <= * is unaffected.