CVE-2026-98650 KVM: s390: Fix potential races in dat skey functions
A race condition in Linux KVM s390 storage key functions can cause system crashes, requiring local privileged access to exploit.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98650?
CVE-2026-98650 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix potential races in dat skey functions
When dat_cond_set_storage_key() finds a large page, it will conditionally set the storage key in absolute memory using large_crste_to_phys() to get the absolute address.
There is a race window between dat_entry_walk() and large_crste_to_phys(): the large page could have been split concurrently, and large_crste_to_phys() might be called with a crste that does not designate a large page, leading to crashes.
Similar issues were also present in dat_set_storage_key().
dat_get_storage_key() and dat_reset_reference_bit() did instead check for a potential concurrent splitting of the large page, but then handled it incorrectly.
Fix by performing a READ_ONCE on the crste pointer, checking and using the result, instead of dereferencing the pointer again. In case a race is detacted, try dat_entry_walk() again.
Which versions are affected by CVE-2026-98650?
How do I fix CVE-2026-98650?
Apply the vendor's patch.
Is CVE-2026-98650 being exploited?
There is no known exploitation of CVE-2026-98650 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98650, GHSA-mmwf-2qgq-f8xq, UBUNTU-CVE-2026-98650.