CVE-2026-98403

Received Received - Intake

Buffer Overflow in Linux Kernel Bootloader

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to the IPL parameter conversion helpers and points the destination one byte past early_command_line. The helpers subtract one from the unsigned size and write the converted parameter outside the command line buffer. Convert the IPL parameter in the command line parsing buffer first. A parameter beginning with '=' can then replace the existing command line regardless of its length, while other parameters are appended only when space remains.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98403

EUVD

EUVD-2026-101052

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5ecb2da660ab8eddafe059a6a8a708465db89ca2
Linux	Linux	5ecb2da660ab8eddafe059a6a8a708465db89ca2
Linux	Linux	5ecb2da660ab8eddafe059a6a8a708465db89ca2
Linux	Linux	5ecb2da660ab8eddafe059a6a8a708465db89ca2
Linux	Linux	5.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow risk in the s390/boot component. When a command line is nearly full, a function called append_ipl_block_parm() incorrectly calculates the space for appending IPL parameters, leading to writing outside the intended buffer. This happens because the function subtracts one from an unsigned size and writes one byte past the command line buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390 architecture boot process and does not have direct detection commands for network or system compromise. It involves a buffer overflow in IPL parameter handling during system boot. Check your kernel version for the patched release and monitor boot logs for unusual command line modifications.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially causing system crashes, privilege escalation, or arbitrary code execution. Systems using affected Linux kernel versions may be vulnerable to denial-of-service or more severe security breaches if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue related to command line buffer handling during boot, which does not involve data processing, storage, or access that would impact regulatory compliance requirements.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor official Linux kernel security advisories for patches.

Hi! I’m here to help you understand CVE-2026-98403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70