CVE-2026-72011

A flaw was found in the Linux kernel's s390/diag component. A local user could exploit a missing bounds check when handling a user-controlled 'level' variable, which is used to read from an array. This vulnerability could lead to information disclosure through speculative execution, potentially allowing an attacker to access sensitive data.

A flaw of low impact was found in the Linux kernel's s390/diag310 memory topology handling (arch/s390/kernel/diag/diag310.c), used on the s390x (IBM zSystems) architecture. In memtop_get_page_count(), a user-space controlled 'level' value is used as an index into an array; although the value is architecturally bounds checked, the missing array_index_nospec() call allows speculative out-of-bounds reads. A local, unprivileged attacker could use this to establish a Spectre v1 style side channel and potentially disclose sensitive kernel memory contents. Red Hat rates the impact of this flaw as Low because it is not network reachable, requires the ability to run code locally, and provides only a limited and hard-to-exploit speculative disclosure primitive with no expected integrity or availability impact. The vulnerable diag310 memory topology code is present in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9), Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3), and Red Hat In-Vehicle OS 2 streams, which are affected with the fix deferred to a future update; earlier RHEL 6, 7, and 8 streams, the RHEL 9.2.0.z, 9.4.z, and 9.6.z update streams, and RHEL 10.0.z are not affected because the vulnerable code is not present. The residual risk of the deferral is limited to possible local disclosure of kernel memory contents through speculative execution; no privilege escalation, integrity, or availability impact is expected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.