CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy()
A local attacker can cause a denial of service in the Linux kernel s390 debug subsystem by triggering a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98593?
CVE-2026-98593 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/debug: Fix NULL pointer dereference in debug_info_copy()
When debug_register_static() fails, it clears areas, active_pages and active_entries but leaves the area bounds unchanged. Copying such an area, either by opening its view file or via debug_dump(), makes debug_info_copy() dereference the NULL pointers.
Skip the copy loop when the source has no areas.
Which versions are affected by CVE-2026-98593?
How do I fix CVE-2026-98593?
Apply the vendor's patch.
Is CVE-2026-98593 being exploited?
There is no known exploitation of CVE-2026-98593 in the wild and no public exploit code.
Sources
Also known as AZL-109208, BELL-CVE-2026-98593, DEBIAN-CVE-2026-98593, GHSA-v4qr-c46c-6qg3, UBUNTU-CVE-2026-98593.