CVE-2026-98400 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel configurations, particularly those using s390/ipl and kdump, should assess their exposure to this vulnerability. This includes reviewing kdump configurations and ensuring that re-IPL parameter blocks are properly set for all IPL types.

Why it matters

This vulnerability can lead to NULL dereference errors in kdump processes when no re-IPL parameter block is available. Defenders should verify kdump configurations and update machine_crash_shutdown() to handle NULL reipl_block_actual values.

• Potential NULL dereference errors in kdump processes.
• Need for verification of re-IPL parameter block presence in kdump configurations.
• Possible impact on system stability during kdump operations.

Technical summary

The Linux kernel's s390/ipl component is vulnerable to a NULL dereference when kdump is used without a re-IPL parameter block. This occurs because the os_info entry is updated unconditionally in machine_crash_shutdown(), leading to a potential NULL pointer dereference when reipl_block_actual is NULL. The vulnerability can be mitigated by verifying the presence of re-IPL parameter blocks in kdump configurations and updating machine_crash_shutdown() to handle NULL reipl_block_actual values. This fix ensures that kdump collects the dump and reboots without setting a re-IPL parameter block.

Defensive priority

Defenders should prioritize verifying the presence of re-IPL parameter blocks in their kdump configurations to prevent potential NULL dereferences. This is particularly important for IPL types that might not provide an IPL parameter block, such as HMC FTP boot or QEMU direct kernel boot.

Recommended defensive actions

• Verify kdump configurations to ensure re-IPL parameter blocks are properly set for all IPL types.
• Review and update machine_crash_shutdown() to handle NULL reipl_block_actual values.
• Monitor for potential NULL dereference errors in kdump processes.
• Perform a thorough review of kdump configurations to identify potential exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is resolved by skipping the os_info update when no re-IPL parameter block is available. This fix ensures that kdump collects the dump and reboots without setting a re-IPL parameter block.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.