CVE-2026-98399

A flaw was found in the Linux kernel. On s390 (IBM Z) systems booted without an Initial Program Load (IPL) parameter block, such as during direct kernel boot, the kernel does not verify the parameter block before dereferencing it during dump operations. A local privileged user could trigger this condition during system shutdown or dump preparation, causing a null pointer dereference. This issue results in a kernel crash, leading to a denial of service (DoS).

A low severity flaw was found in the Linux kernel s390 (IBM Z) IPL subsystem. On systems booted without an IPL parameter block, such as via HMC FTP boot or QEMU direct kernel boot, reipl_type_init() selects IPL_TYPE_UNKNOWN and reipl_block_actual remains NULL, yet dump_reipl_run() unconditionally dereferences that pointer while preparing the lowcore fields for a stand-alone dump. A local privileged user who triggers a stand-alone dump on such a system can cause a NULL pointer dereference and kernel crash, resulting in a denial of service; alternatively, when address zero happens to contain readable lowcore data, the stand-alone dumper completes the dump and enters disabled wait, preventing the expected automatic re-IPL. Only availability is impacted; there is no effect on confidentiality or integrity. Red Hat Enterprise Linux 6 is an out-of-support stream (OOSS), while the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS, and the OpenShift Container Platform RHEL CoreOS kernels are affected with fixes currently deferred: triggering the flaw requires local administrative privileges on an s390 system booted in an uncommon configuration, and the residual risk is limited to a denial of service during stand-alone dump or shutdown workflows. Red Hat assesses this issue as LOW severity, lower than the upstream rating, because exploitation requires local privileged access and an uncommon s390 boot configuration, and the impact is confined to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

On affected s390 systems booted without an IPL parameter block (for example via HMC FTP boot or QEMU direct kernel boot), using kdump instead of the stand-alone dumper avoids the vulnerable code path, because kdump passes the re-IPL parameter block through os_info rather than through the lowcore IPL parameter block address and checksum. For environments that rely on the stand-alone dumper, booting the system with a valid IPL parameter block also avoids the NULL dereference path, as valid re-IPL parameter blocks are handled as before. Fixes for the affected Red Hat kernel streams are currently deferred and no fixed package version is available at this time.