NULL Dereference Vulnerability in Linux Kernel Affecting s390/ipl Framework

CVE-2026-98400

What is CVE-2026-98400?

A vulnerability exists in the Linux kernel's s390/ipl framework, specifically related to handling initialization parameter blocks during kdump. When certain Initial Program Load (IPL) types do not provide a necessary parameter block, it may lead to a NULL dereference in the reipl_block_actual. This happens due to changes in the os_info update processes, introduced in a recent kernel commit. If the system attempts to dereference this NULL value, it can result in unpredictable behavior during system crashes, causing instability in the dump collection process. The fix prevents this dereference by skipping the os_info update when the appropriate parameter block is absent, thereby safeguarding system reliability during kdump operations.

References