CVE-2026-98650 Linux CVE debrief

Who should care

Linux system administrators, KVM users on s390, and security teams responsible for Linux kernel-based systems should assess exposure and verify if running kernel versions are affected.

Why it matters

A race condition vulnerability in the Linux kernel's KVM implementation for s390 could lead to system crashes when handling storage keys, requiring assessment and potential updates to fixed kernel versions.

• Potential system crashes due to improper handling of storage keys
• Need to verify if running kernel versions are affected and update to fixed versions
• Possible impact on system stability and availability

Technical summary

The Linux kernel's KVM implementation for s390 has a race condition vulnerability in dat skey functions, which could lead to crashes when handling storage keys. The issue arises from a race window between dat_entry_walk() and large_crste_to_phys(), where a large page could be split concurrently, causing large_crste_to_phys() to be called with a crste that does not designate a large page. This vulnerability requires assessment and potential updates to fixed kernel versions. The Linux kernel patch fixing the vulnerability is referenced, but specific kernel versions affected or fixed are not provided.

Defensive priority

Assess exposure in Linux kernel-based systems using KVM on s390; verify if running kernel versions are affected and update to fixed versions if available.

Recommended defensive actions

• Assess if Linux kernel-based systems using KVM on s390 are deployed in the environment.
• Verify if running kernel versions are affected by checking official kernel update advisories.
• Update to fixed kernel versions if available.
• Monitor system logs for potential crashes or errors related to KVM and storage key handling.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or fixed kernel versions; further verification is needed. The Linux kernel patch fixing the vulnerability is referenced, but specific kernel versions affected or fixed are not provided. To verify exposure, defenders should check official kernel update advisories and review system logs for potential crashes or errors related to KVM and storage key handling. Additionally, assessing if Linux kernel-based systems using KVM on s390 are deployed

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.