CVE-2026-98387

A low impact flaw was found in the Linux kernel's s390 cryptographic subsystem, in the AES skcipher implementation (aes_s390) used by Red Hat Enterprise Linux and other Red Hat products that ship affected kernels. The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If the walk initialization fails, the walk structure may be in an undefined state, and continuing to process data with it can access uninitialized memory, leading to a kernel crash and local denial of service, with potential information disclosure. A local user with low privileges could trigger this issue by submitting cryptographic requests that exercise the affected s390 AES code paths and cause the walk setup to fail.

Red Hat Enterprise Linux 7 and 8 (including kernel-rt and OpenShift releases built on RHEL 8 CoreOS) are not affected because the vulnerable code is not present in those kernels, and RHEL 6 ELS is out of support scope. For the affected streams (Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases based on RHEL 9 CoreOS), the fix is deferred because this is a low-severity error-handling issue that requires an uncommon failure during cryptographic walk setup to trigger; the residual risk is primarily local denial of service on s390x (IBM Z) systems. Although the Red Hat CVSS 3.1 base score is 5.5 (Moderate) with high availability impact, the flaw is rated low impact overall because exploitation requires a local actor, the failing path is difficult to reach reliably, and no controlled information disclosure or privilege escalation primitive is established.