CVE-2026-98400
In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipl_type_init() selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL. kdump passes the re-IPL parameter block to the dump kernel through os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl block checksum calculation"), the os_info entry was added only for IPL types which initialized reipl_block_actual. That commit moved the os_info update to machine_crash_shutdown(), making it unconditional. As a result, set_os_info_reipl_block() dereferences reipl_block_actual for IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero contains readable lowcore data and the resulting empty os_info entry is ignored by the dump kernel. Skip the os_info update when no re-IPL parameter block is available. Kdump then collect the dump and reboot without setting re-IPL parameter block.
Affected versions
Linux kernel versions
4.17
and later are affected. Fixed in
6.6.158,
6.12.111,
6.18.53,
7.2.7,
7.3-rc2
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-98400?
CVE-2026-98400 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.17 onward and has been patched in 6.6.158, 6.12.111, 6.18.53 and others. CVE-2026-98400 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98400?
Yes. CVE-2026-98400 has been patched. Fixed versions include 6.6.158, 6.12.111, 6.18.53 and others. If you are running Linux kernel 4.17 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98400 actively exploited?
No. CVE-2026-98400 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.