CVE-2026-72011

A flaw of low impact was found in the Linux kernel's s390/diag310 memory topology handling (arch/s390/kernel/diag/diag310.c), used on the s390x (IBM zSystems) architecture. In memtop_get_page_count(), a user-space controlled 'level' value is used as an index into an array; although the value is architecturally bounds checked, the missing array_index_nospec() call allows speculative out-of-bounds reads. A local, unprivileged attacker could use this to establish a Spectre v1 style side channel and potentially disclose sensitive kernel memory contents. Red Hat rates the impact of this flaw as Low because it is not network reachable, requires the ability to run code locally, and provides only a limited and hard-to-exploit speculative disclosure primitive with no expected integrity or availability impact. The vulnerable diag310 memory topology code is present in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9), Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3), and Red Hat In-Vehicle OS 2 streams, which are affected with the fix deferred to a future update; earlier RHEL 6, 7, and 8 streams, the RHEL 9.2.0.z, 9.4.z, and 9.6.z update streams, and RHEL 10.0.z are not affected because the vulnerable code is not present. The residual risk of the deferral is limited to possible local disclosure of kernel memory contents through speculative execution; no privilege escalation, integrity, or availability impact is expected.