CVE-2026-98400

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might

not provide an IPL parameter block. In this case, reipl_type_init()

selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.

kdump passes the re-IPL parameter block to the dump kernel through

os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl

block checksum calculation"), the os_info entry was added only for

IPL types which initialized reipl_block_actual. That commit moved the

os_info update to machine_crash_shutdown(), making it unconditional. As

a result, set_os_info_reipl_block() dereferences reipl_block_actual for

IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero

contains readable lowcore data and the resulting empty os_info entry is

ignored by the dump kernel.

Skip the os_info update when no re-IPL parameter block is available.

Kdump then col

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References