NULL Dereference Vulnerability in Linux Kernel Affecting s390/ipl

CVE-2026-98399

What is CVE-2026-98399?

A vulnerability in the Linux kernel's s390/ipl module can lead to a NULL dereference during the dump process when the IPL parameter block is unavailable. In certain initialization types, such as HMC FTP boot or QEMU direct kernel boot, necessary re-IPL parameters may not be provided, which can leave the address for the IPL parameter block as NULL. When the dump process attempts to access this NULL reference, it may cause the system to enter a disabled wait state, potentially impacting system reliability. Fixes have been implemented to ensure a zero address is explicitly recorded in such scenarios, while valid parameter blocks are processed normally.

References