CVE-2026-98403

A flaw was found in the Linux kernel's s390 boot code. This flaw can lead to a Denial of Service (DoS) through memory corruption during system startup. When the early boot command-line buffer is nearly full, appending Initial Program Load (IPL) parameters triggers an integer underflow, causing an out-of-bounds write outside the designated buffer. A user capable of specifying custom boot parameters can exploit this vulnerability during system initialization to crash the system.

An out of bounds write can occur during s390 early boot when early_command_line occupies all available space except for its terminating byte. append_ipl_block_parm() then passes a zero destination size and a pointer beyond the command line buffer to an IPL parameter conversion helper. The helper subtracts one from the unsigned size, producing a very large effective bound and allowing converted IPL parameter data to overwrite adjacent boot memory. The demonstrated impact includes corruption of boot data, altered boot behavior, or failure to boot. The broader confidentiality and integrity impact depends on the affected memory layout and is not proven as a practical privilege escalation. For the CVSS the PR:H value is used because reliable triggering normally requires administrative control over the s390 boot command line or IPL parameter block. The issue is not directly network reachable and executes before normal userspace starts. Impact is at least denial of service and boot state corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.