CVE-2026-98387

A flaw was found in the Linux kernel's s390 cryptographic subsystem. Missing error code verification during AES (Advanced Encryption Standard) cipher operations allows data processing loops to execute even if setup fails. A local user could exploit this vulnerability during cryptographic operations to cause the system to access uninitialized memory, leading to a Denial of Service (DoS) via a kernel crash or potential information disclosure.

A low impact flaw was found in the Linux kernel's s390 cryptographic subsystem, in the AES skcipher implementation (aes_s390) used by Red Hat Enterprise Linux and other Red Hat products that ship affected kernels. The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If the walk initialization fails, the walk structure may be in an undefined state, and continuing to process data with it can access uninitialized memory, leading to a kernel crash and local denial of service, with potential information disclosure. A local user with low privileges could trigger this issue by submitting cryptographic requests that exercise the affected s390 AES code paths and cause the walk setup to fail.

Red Hat Enterprise Linux 7 and 8 (including kernel-rt and OpenShift releases built on RHEL 8 CoreOS) are not affected because the vulnerable code is not present in those kernels, and RHEL 6 ELS is out of support scope. For the affected streams (Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases based on RHEL 9 CoreOS), the fix is deferred because this is a low-severity error-handling issue that requires an uncommon failure during cryptographic walk setup to trigger; the residual risk is primarily local denial of service on s390x (IBM Z) systems. Although the Red Hat CVSS 3.1 base score is 5.5 (Moderate) with high availability impact, the flaw is rated low impact overall because exploitation requires a local actor, the failing path is difficult to reach reliably, and no controlled information disclosure or privilege escalation primitive is established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.