CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
A NULL pointer dereference in the Linux kernel s390 IPL code can cause a denial of service during stand-alone dumps when no re-IPL parameter block is provided.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98399?
CVE-2026-98399 is a vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
Unlike kdump, which passes the re-IPL parameter block through os_info, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore.
Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case reipl_type_init() selects IPL_TYPE_UNKNOWN and reipl_block_actual remains NULL. Nevertheless, dump_reipl_run() unconditionally dereferences it when preparing the lowcore fields. This may happen to work by chance when address zero contains readable lowcore data. A zero IPL parameter block address is then stored in lowcore, causing the stand-alone dumper to enter disabled wait after completing the dump.
Explicitly store a zero IPL parameter block address and checksum when no re-IPL parameter block is available. This does not change the behavior: the stand-alone dumper completes the dump and halts, while valid re-IPL parameter blocks continue to be handled as before.
Which versions are affected by CVE-2026-98399?
How do I fix CVE-2026-98399?
Apply the vendor's patch.
Is CVE-2026-98399 being exploited?
There is no known exploitation of CVE-2026-98399 in the wild and no public exploit code.
Sources
Also known as AZL-108129, BELL-CVE-2026-98399, DEBIAN-CVE-2026-98399, GHSA-wvr7-cc68-fmx4, UBUNTU-CVE-2026-98399.