CVE-2026-98403
Received
Received - Intake
Buffer Overflow in Linux Kernel Bootloader
Vulnerability report for CVE-2026-98403, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
s390/boot: Avoid IPL parameter append past command line
A command line may occupy all but the terminating byte of
COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size
to the IPL parameter conversion helpers and points the destination one
byte past early_command_line. The helpers subtract one from the unsigned
size and write the converted parameter outside the command line buffer.
Convert the IPL parameter in the command line parsing buffer first. A
parameter beginning with '=' can then replace the existing command line
regardless of its length, while other parameters are appended only when
space remains.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 5ecb2da660ab8eddafe059a6a8a708465db89ca2 |
| Linux | Linux | 5ecb2da660ab8eddafe059a6a8a708465db89ca2 |
| Linux | Linux | 5ecb2da660ab8eddafe059a6a8a708465db89ca2 |
| Linux | Linux | 5ecb2da660ab8eddafe059a6a8a708465db89ca2 |
| Linux | Linux | 5.16 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
