CVE-2026-99126 s390/ctcm: Prevent XID null dereference

Not scored Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-99126?

CVE-2026-99126 is a vulnerability in Linux, published on 28 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

s390/ctcm: Prevent XID null dereference

The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->saved_xid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference.

Fix this by using the always available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 for validation errors.

Which versions are affected by CVE-2026-99126?

How do I fix CVE-2026-99126?

Upgrade to a fixed version.

Is CVE-2026-99126 being exploited?

There is no known exploitation of CVE-2026-99126 in the wild and no public exploit code.

Sources

Also known as AZL-111233, BELL-CVE-2026-99126, DEBIAN-CVE-2026-99126, GHSA-pcv7-392q-p29w, UBUNTU-CVE-2026-99126.