CVE-2026-98403 s390/boot: Avoid IPL parameter append past command line
A buffer overflow in the s390 Linux kernel boot process allows attackers to write outside the command line buffer, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98403?
CVE-2026-98403 is a memory corruption vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/boot: Avoid IPL parameter append past command line
A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to the IPL parameter conversion helpers and points the destination one byte past early_command_line. The helpers subtract one from the unsigned size and write the converted parameter outside the command line buffer.
Convert the IPL parameter in the command line parsing buffer first. A parameter beginning with '=' can then replace the existing command line regardless of its length, while other parameters are appended only when space remains.
Which versions are affected by CVE-2026-98403?
How do I fix CVE-2026-98403?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98403 being exploited?
There is no known exploitation of CVE-2026-98403 in the wild and no public exploit code.
Sources
Also known as AZL-108102, BELL-CVE-2026-98403, DEBIAN-CVE-2026-98403, GHSA-7qjr-375p-687v, UBUNTU-CVE-2026-98403.