In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions When dat_cond_set_storage_key() finds a large page, it will conditionally set the storage key in absolute memory using large_crste_to_phys() to get the absolute address. There is a race window between dat_entry_walk() and large_crste_to_phys(): the large page could have been split concurrently, and large_crste_to_phys() might be called with a crste that does not designate a large page, leading to crashes. Similar issues were also present in dat_set_storage_key(). dat_get_storage_key() and dat_reset_reference_bit() did instead check for a potential concurrent splitting of the large page, but then handled it incorrectly. Fix by performing a READ_ONCE on the crste pointer, checking and using the result, instead of dereferencing the pointer again. In case a race is detacted, try dat_entry_walk() again.

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. A race condition occurs when storage key management functions process large memory pages that are simultaneously split by another thread. A local user could exploit this timing issue during concurrent memory operations to crash the system, leading to a Denial of Service (DoS).

A race in KVM s390 DAT storage key handling can occur when a large page is split after dat_entry_walk but before the caller converts the CRSTE into an absolute physical address. The changed entry may then be interpreted as a large page entry, causing storage key operations to use an incorrect physical address and potentially crash the host. For the CVSS the PR:L value is used because a local user context or a guest workload with access to the affected KVM storage key operations is required. AC:H is used because successful triggering depends on winning a race with concurrent large page splitting. The issue is not directly network reachable, although a remotely controlled workload inside an existing guest could exercise the guest side path. The demonstrated impact is host denial of service. In the paranoid case, limited confidentiality and integrity impact is retained because an incorrect physical page storage key or reference state may be read or modified, but no UAF, OOB write, arbitrary memory write, or reliable privilege escalation primitive is established. Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98650 https://nvd.nist.gov/vuln/detail/CVE-2026-98650 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98650.mbox