CVE-2026-98650
Description
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. A race condition occurs when storage key management functions process large memory pages that are simultaneously split by another thread. A local user could exploit this timing issue during concurrent memory operations to crash the system, leading to a Denial of Service (DoS).
Statement
A race in KVM s390 DAT storage key handling can occur when a large page is split after dat_entry_walk but before the caller converts the CRSTE into an absolute physical address. The changed entry may then be interpreted as a large page entry, causing storage key operations to use an incorrect physical address and potentially crash the host. For the CVSS the PR:L value is used because a local user context or a guest workload with access to the affected KVM storage key operations is required. AC:H is used because successful triggering depends on winning a race with concurrent large page splitting. The issue is not directly network reachable, although a remotely controlled workload inside an existing guest could exercise the guest side path. The demonstrated impact is host denial of service. In the paranoid case, limited confidentiality and integrity impact is retained because an incorrect physical page storage key or reference state may be read or modified, but no UAF, OOB write, arbitrary memory write, or reliable privilege escalation primitive is established.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When a race condition makes it possible to bypass a resource cleanup routine or trigger multiple initialization routines, it may lead to resource exhaustion.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
When a race condition allows multiple control flows to access a resource simultaneously, it might lead the product(s) into unexpected states, possibly resulting in a crash.
Confidentiality,Integrity
Technical Impact: Read Files or Directories; Read Application Data
When a race condition is combined with predictable resource names and loose permissions, it may be possible for an attacker to overwrite or access confidential data (CWE-59).
Access Control
Technical Impact: Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity; Bypass Protection Mechanism
This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
