CVE-2026-98400 - Vulnerability Details

- s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might
not provide an IPL parameter block. In this case, reipl_type_init()
selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.

kdump passes the re-IPL parameter block to the dump kernel through
os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl
block checksum calculation"), the os_info entry was added only for
IPL types which initialized reipl_block_actual. That commit moved the
os_info update to machine_crash_shutdown(), making it unconditional. As
a result, set_os_info_reipl_block() dereferences reipl_block_actual for
IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero
contains readable lowcore data and the resulting empty os_info entry is
ignored by the dump kernel.

Skip the os_info update when no re-IPL parameter block is available.
Kdump then collect the dump and reboot without setting re-IPL parameter
block.

Published: 2026-10-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference occurs when the kdump mechanism attempts to use an "IPL parameter block" that does not exist. The faulty dereference forces the kernel to crash during a reboot or crash‑dump operation, causing the system to fail to produce a memory dump and to reboot automatically. The result is an interruption of availability rather than an integrity or confidentiality compromise.

Affected Systems

All Linux kernels running on the s390 architecture that have not incorporated the patch which skips the os_info update when the IPL parameter block is missing are vulnerable. This includes any unpatched release that predates commit 3b9678472bab.

Risk and Exploitability

The CVSS score of 5.5 reflects a moderate severity, and an EPSS score of <1% suggests a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is local privilege or any actor who can trigger a kernel crash through the kdump interface; remote exploitation would require an additional vulnerability to gain the necessary privilege.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3b9678472bab86ae654cf2c18d5dd551558045be`	affected	< 030e88812435fc5d6aa42eee41fa77b5ea620327
`3b9678472bab86ae654cf2c18d5dd551558045be`	affected	< 92d0829eae257544b6b0faccb6e7079c45e22d48
`3b9678472bab86ae654cf2c18d5dd551558045be`	affected	< 50f9c40768e84f30d374235b3ee3850a94d9ac29
`3b9678472bab86ae654cf2c18d5dd551558045be`	affected	< b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd
`3b9678472bab86ae654cf2c18d5dd551558045be`	affected	< 7f918871112e8e7c581e99eb8e545af4e59c8367

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3b9678472bab86ae654cf2c18d5dd551558045be,030e88812435fc5d6aa42eee41fa77b5ea620327)`	affected	code_commit	—
`[3b9678472bab86ae654cf2c18d5dd551558045be,92d0829eae257544b6b0faccb6e7079c45e22d48)`	affected	code_commit	—
`[3b9678472bab86ae654cf2c18d5dd551558045be,50f9c40768e84f30d374235b3ee3850a94d9ac29)`	affected	code_commit	—
`[3b9678472bab86ae654cf2c18d5dd551558045be,b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd)`	affected	code_commit	—
`[3b9678472bab86ae654cf2c18d5dd551558045be,7f918871112e8e7c581e99eb8e545af4e59c8367)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the fix for CVE-2026-98400, such as the commit 3b9678472bab or a downstream security update.
Reboot the system after the kernel update to ensure the patched kernel image is active.
If an update cannot be applied immediately, restrict privileged users who can invoke a kernel crash via the kdump interface and monitor kernel logs for abnormal termination events as a temporary measure.

Generated by OpenCVE AI on October 16, 2026 at 22:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98400.mbox
https://git.kernel.org/stable/c/030e88812435fc5d6aa42eee41fa77b5ea620327
https://git.kernel.org/stable/c/50f9c40768e84f30d374235b3ee3850a94d9ac29
https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367
https://git.kernel.org/stable/c/92d0829eae257544b6b0faccb6e7079c45e22d48
https://git.kernel.org/stable/c/b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd
https://nvd.nist.gov/vuln/detail/CVE-2026-98400
https://www.cve.org/CVERecord?id=CVE-2026-98400

History

Fri, 16 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98400.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98400 https://www.cve.org/CVERecord?id=CVE-2026-98400
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Thu, 15 Oct 2026 23:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Thu, 15 Oct 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 14 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipl_type_init() selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL. kdump passes the re-IPL parameter block to the dump kernel through os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl block checksum calculation"), the os_info entry was added only for IPL types which initialized reipl_block_actual. That commit moved the os_info update to machine_crash_shutdown(), making it unconditional. As a result, set_os_info_reipl_block() dereferences reipl_block_actual for IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero contains readable lowcore data and the resulting empty os_info entry is ignored by the dump kernel. Skip the os_info update when no re-IPL parameter block is available. Kdump then collect the dump and reboot without setting re-IPL parameter block.
Title		s390/ipl: Fix NULL deref in kdump without re-IPL parm block
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/030e88812435fc5d6aa42eee41fa77b5ea620327 https://git.kernel.org/stable/c/50f9c40768e84f30d374235b3ee3850a94d9ac29 https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367 https://git.kernel.org/stable/c/92d0829eae257544b6b0faccb6e7079c45e22d48 https://git.kernel.org/stable/c/b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-14T13:26:00.872Z

Updated: 2026-10-19T09:18:53.762Z

Reserved: 2026-09-25T10:25:14.346Z

Link: CVE-2026-98400

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-14T14:17:51.010

Modified: 2026-10-19T10:18:44.820

Link: CVE-2026-98400

Redhat

Severity : Low

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98400 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-19T19:00:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object