CVE-2026-98400
Description
A flaw was found in the Linux kernel's s390 architecture. On systems booted without an Initial Program Load (IPL) parameter block, such as direct virtual machine boots, the kernel crash shutdown handler unconditionally dereferences an uninitialized pointer when preparing crash data. If a crash occurs, this null pointer dereference disrupts the crash dump process and prevents the system from rebooting properly, resulting in a denial of service (DoS).
Statement
A LOW impact NULL pointer dereference flaw was found in the Linux kernel on the s390 architecture. On s390 systems booted without an IPL parameter block, such as HMC FTP boot or QEMU direct kernel boot, the re-IPL parameter block pointer (reipl_block_actual) remains NULL, yet the kernel crash shutdown handler unconditionally dereferences it when preparing crash data for the kdump kernel. If a crash occurs, this disrupts the crash dump process and can prevent the system from rebooting properly, resulting in a denial of service. Exploiting this issue requires local access with sufficient privileges to trigger a kernel crash on an affected s390 system booted with such an IPL method; it is not network-reachable and has no impact on confidentiality or integrity. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels shipped with OpenShift Container Platform are affected; Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present in that release, and Red Hat Enterprise Linux 6 is out of support scope. The fix is currently deferred for the affected releases because the flaw is limited to the crash recovery path on s390 systems using specific boot configurations and is rated LOW impact; the residual risk of the delay is confined to a failed crash dump collection or an unclean reboot on those configurations. Red Hat's LOW impact rating reflects that the CVSS 3.1 base score of 5.5 (MODERATE) does not account for the specific boot configuration and privileged crash-triggering access this issue actually requires.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
