CVE-2026-98399
Description
A flaw was found in the Linux kernel. On s390 (IBM Z) systems booted without an Initial Program Load (IPL) parameter block, such as during direct kernel boot, the kernel does not verify the parameter block before dereferencing it during dump operations. A local privileged user could trigger this condition during system shutdown or dump preparation, causing a null pointer dereference. This issue results in a kernel crash, leading to a denial of service (DoS).
Statement
A low severity flaw was found in the Linux kernel s390 (IBM Z) IPL subsystem. On systems booted without an IPL parameter block, such as via HMC FTP boot or QEMU direct kernel boot, reipl_type_init() selects IPL_TYPE_UNKNOWN and reipl_block_actual remains NULL, yet dump_reipl_run() unconditionally dereferences that pointer while preparing the lowcore fields for a stand-alone dump. A local privileged user who triggers a stand-alone dump on such a system can cause a NULL pointer dereference and kernel crash, resulting in a denial of service; alternatively, when address zero happens to contain readable lowcore data, the stand-alone dumper completes the dump and enters disabled wait, preventing the expected automatic re-IPL. Only availability is impacted; there is no effect on confidentiality or integrity. Red Hat Enterprise Linux 6 is an out-of-support stream (OOSS), while the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS, and the OpenShift Container Platform RHEL CoreOS kernels are affected with fixes currently deferred: triggering the flaw requires local administrative privileges on an s390 system booted in an uncommon configuration, and the residual risk is limited to a denial of service during stand-alone dump or shutdown workflows. Red Hat assesses this issue as LOW severity, lower than the upstream rating, because exploitation requires local privileged access and an uncommon s390 boot configuration, and the impact is confined to availability.
Mitigation
On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Integrity,Confidentiality
Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory
In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
