CVE-2026-98648
Received Received - Intake

Out-of-Bounds Read in Linux Kernel s390/uv

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uv_secret_list struct array only holds up to 85 items per page, resulting in an out of bounds read in find_secret_in_page if the targeted secret is in the next page or not stored at all. Fix this by looping over the number of stored secrets which is the per sub-list count of stored secrets and not the overall count.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98648
EUVD
EUVD-2026-103562

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d
Linux Linux 7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d
Linux Linux 7c9137af2042e0d67aae0ccd84afc8ffc4b0d95d
Linux Linux 6.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel where an out-of-bounds read can occur when the system has more than 85 secrets. The uv_secret_list struct array can only hold up to 85 items per page, causing an error if a secret is located in the next page or not stored at all.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/uv subsystem and may not have direct detection commands. Monitor kernel logs for out-of-bounds read errors or crashes related to uv_secret_list. Check for system instability or unexpected behavior in systems using s390 architecture with more than 85 secrets.

Impact Analysis

This vulnerability may allow unauthorized access to sensitive data or system crashes due to memory corruption. It could potentially expose secrets or cause instability in systems running affected Linux kernel versions.

Mitigation Strategies

Apply the kernel patch that fixes the uv_secret_list handling. Update to a Linux kernel version that includes the fix for this issue. If immediate patching is not possible, restrict access to systems with more than 85 secrets or monitor them closely for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart