CVE-2026-98400

Received Received - Intake

NULL Pointer Dereference in Linux Kernel kdump

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipl_type_init() selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL. kdump passes the re-IPL parameter block to the dump kernel through os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl block checksum calculation"), the os_info entry was added only for IPL types which initialized reipl_block_actual. That commit moved the os_info update to machine_crash_shutdown(), making it unconditional. As a result, set_os_info_reipl_block() dereferences reipl_block_actual for IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero contains readable lowcore data and the resulting empty os_info entry is ignored by the dump kernel. Skip the os_info update when no re-IPL parameter block is available. Kdump then collect the dump and reboot without setting re-IPL parameter block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98400

EUVD

EUVD-2026-101049

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	3b9678472bab86ae654cf2c18d5dd551558045be
Linux	Linux	3b9678472bab86ae654cf2c18d5dd551558045be
Linux	Linux	3b9678472bab86ae654cf2c18d5dd551558045be
Linux	Linux	3b9678472bab86ae654cf2c18d5dd551558045be
Linux	Linux	3b9678472bab86ae654cf2c18d5dd551558045be
Linux	Linux	4.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's s390/ipl component. It occurs when kdump runs without a re-IPL parameter block, causing a NULL pointer dereference in set_os_info_reipl_block(). This happens because reipl_block_actual remains NULL for certain IPL types like HMC FTP boot or QEMU direct kernel boot, leading to a crash when the os_info entry is unconditionally updated.

Detection Guidance

This vulnerability affects the Linux kernel's s390 IPL handling during kdump scenarios. Detection requires checking kernel logs for NULL dereference errors related to reipl_block_actual during kdump operations. Monitor logs for crashes or hangs during crash recovery processes.

Impact Analysis

If you use kdump on a s390 system with IPL types that don't provide a re-IPL parameter block, this vulnerability could cause the dump kernel to crash during a system failure. This prevents proper crash dump collection and may lead to data loss or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel issue in s390/ipl kdump functionality. No evidence suggests data privacy or security compliance impacts from this specific flaw.

Mitigation Strategies

Apply the kernel patch that fixes the NULL dereference in reipl_block_actual handling during kdump. Ensure your kdump configuration does not rely on IPL_TYPE_UNKNOWN without proper parameter blocks. Update to a patched kernel version immediately.

Hi! I’m here to help you understand CVE-2026-98400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70