CVE-2026-98399
N/AIn the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through os_info, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case reipl_type_init() selects IPL_TYPE_UNKNOWN and reipl_block_actual remains NULL. Nevertheless, dump_reipl_run() unconditionally dereferences it when preparing the lowcore fields. This may happen to work by chance when address zero contains readable lowcore data. A zero IPL parameter block address is then stored in lowcore, causing the stand-alone dumper to enter disabled wait after completing the dump. Explicitly store a zero IPL parameter block address and checksum when no re-IPL parameter block is available. This does not change the behavior: the stand-alone dumper completes the dump and halts, while valid re-IPL parameter blocks continue to be handled as before.
NO EXPLOITATION SIGNALS
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 10th percentile
○ In CISA KEV
○ Catalogued PoC
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
References and research data (JSON)
Vendor product assessments
Showing 32 of 277 vendor product statements; 245 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-64k-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-modules-extra
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-debug-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-core
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-doc as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-doc
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-64k-modules-extra as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-modules-extra
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules-extra
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel.src as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel?arch=src
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-debug as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- no fix planned: Out of support scope
perf as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/perf
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- no fix planned: Out of support scope
kernel-doc as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-doc
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-doc
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel.src as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel?arch=src
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-debug as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-ipaclones-internal as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-ipaclones-internal
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-devel
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-internal
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-64k as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-64k-debug-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-modules-internal
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-abi-stablelists as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-stablelists
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-modules-extra
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-ipaclones-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-ipaclones-internal
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-64k-debug-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-modules-partner
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-64k-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-modules-partner
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules-extra
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-internal
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-uki-virt-addons as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt-addons
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
kernel-zfcpdump-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-modules-partner
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
- workaround: On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.
- none available: Fix deferred
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98399.json Red Hat · CVE-2026-98399 · Updated 2026-10-18T08:29:19+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101048 EUVD · EUVD-2026-101048
Technical & other
- https://git.kernel.org/stable/c/41647864e62b28388ecccc23a82f0e0a091f4ef2CVE record · Linux · Updated 2026-10-19T09:18:52.784Z
NVD · CVE-2026-98399 · Updated 2026-10-19T10:18:44.700 - https://git.kernel.org/stable/c/aed56fa3108b7095e6a048e134981506c056a6cbCVE record · Linux · Updated 2026-10-19T09:18:52.784Z
NVD · CVE-2026-98399 · Updated 2026-10-19T10:18:44.700 - https://git.kernel.org/stable/c/8d7988e8116c3d29d9e02ca9d37ee84577643f2dCVE record · Linux · Updated 2026-10-19T09:18:52.784Z
NVD · CVE-2026-98399 · Updated 2026-10-19T10:18:44.700 - https://git.kernel.org/stable/c/280ff19853440d59e031cd8fe161e81305721262CVE record · Linux · Updated 2026-10-19T09:18:52.784Z
NVD · CVE-2026-98399 · Updated 2026-10-19T10:18:44.700 - https://git.kernel.org/stable/c/37f61b71cbc0caefc01022a19ee56fc2510e2e6eCVE record · Linux · Updated 2026-10-19T09:18:52.784Z
NVD · CVE-2026-98399 · Updated 2026-10-19T10:18:44.700 - https://access.redhat.com/security/cve/CVE-2026-98399 Red Hat · CVE-2026-98399 · Updated 2026-10-18T08:29:19+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2552222 Red Hat · CVE-2026-98399 · Updated 2026-10-18T08:29:19+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-98399 Red Hat · CVE-2026-98399 · Updated 2026-10-18T08:29:19+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-98399 Red Hat · CVE-2026-98399 · Updated 2026-10-18T08:29:19+00:00
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98399.mbox Red Hat · CVE-2026-98399 · Updated 2026-10-18T08:29:19+00:00