CVE-2026-98400

A flaw was found in the Linux kernel's s390 architecture. On systems booted without an Initial Program Load (IPL) parameter block, such as direct virtual machine boots, the kernel crash shutdown handler unconditionally dereferences an uninitialized pointer when preparing crash data. If a crash occurs, this null pointer dereference disrupts the crash dump process and prevents the system from rebooting properly, resulting in a denial of service (DoS).

A LOW impact NULL pointer dereference flaw was found in the Linux kernel on the s390 architecture. On s390 systems booted without an IPL parameter block, such as HMC FTP boot or QEMU direct kernel boot, the re-IPL parameter block pointer (reipl_block_actual) remains NULL, yet the kernel crash shutdown handler unconditionally dereferences it when preparing crash data for the kdump kernel. If a crash occurs, this disrupts the crash dump process and can prevent the system from rebooting properly, resulting in a denial of service. Exploiting this issue requires local access with sufficient privileges to trigger a kernel crash on an affected s390 system booted with such an IPL method; it is not network-reachable and has no impact on confidentiality or integrity. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels shipped with OpenShift Container Platform are affected; Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present in that release, and Red Hat Enterprise Linux 6 is out of support scope. The fix is currently deferred for the affected releases because the flaw is limited to the crash recovery path on s390 systems using specific boot configurations and is rated LOW impact; the residual risk of the delay is confined to a failed crash dump collection or an unclean reboot on those configurations. Red Hat's LOW impact rating reflects that the CVSS 3.1 base score of 5.5 (MODERATE) does not account for the specific boot configuration and privileged crash-triggering access this issue actually requires.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.