CVE-2026-98387

Received Received - Intake

Improper Return Code Handling in Linux Kernel s390 Crypto

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk return code handling in aes_s390 The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, and attempting to process data could lead to incorrect behavior or accessing uninitialized memory. Add proper return code checking to ensure correct handling of the walk initialization and walk advance and eventually return to the caller with that return code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98387

EUVD

EUVD-2026-101036

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	7988fb2c03c8cf9936f851ab19a6d21b3c3411c0
Linux	Linux	7988fb2c03c8cf9936f851ab19a6d21b3c3411c0
Linux	Linux	7988fb2c03c8cf9936f851ab19a6d21b3c3411c0
Linux	Linux	7988fb2c03c8cf9936f851ab19a6d21b3c3411c0
Linux	Linux	5.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the s390 cryptographic module. It involves improper handling of return codes from skcipher_walk_virt() in AES encryption functions (ecb_aes_crypt and ctr_aes_crypt). If the function fails, the walk structure may become corrupted, leading to incorrect processing or uninitialized memory access.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/crypto module and requires kernel-level inspection. Detection involves checking kernel logs for errors related to skcipher_walk or AES-S390 operations. Use commands like dmesg | grep -i 'skcipher_walk\|aes_s390' or journalctl -k | grep -i 'skcipher_walk\|aes_s390' to identify issues.

Impact Analysis

This vulnerability could allow attackers to cause system crashes, corrupt data, or potentially execute arbitrary code with kernel privileges. It specifically affects systems using s390 architecture with AES encryption enabled.

Compliance Impact

This vulnerability affects compliance with standards like GDPR and HIPAA by potentially enabling unauthorized memory access or incorrect cryptographic operations. Improper handling of return codes in cryptographic functions could lead to data exposure or integrity issues, violating confidentiality and security requirements mandated by these regulations.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the s390/crypto module. If immediate patching is not possible, disable the affected AES-S390 cipher operations in your kernel configuration or restrict usage of ECB/CTR AES modes until the update is applied.

Hi! I’m here to help you understand CVE-2026-98387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70