CVE-2026-98650

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. A race condition occurs when storage key management functions process large memory pages that are simultaneously split by another thread. A local user could exploit this timing issue during concurrent memory operations to crash the system, leading to a Denial of Service (DoS).

A race in KVM s390 DAT storage key handling can occur when a large page is split after dat_entry_walk but before the caller converts the CRSTE into an absolute physical address. The changed entry may then be interpreted as a large page entry, causing storage key operations to use an incorrect physical address and potentially crash the host. For the CVSS the PR:L value is used because a local user context or a guest workload with access to the affected KVM storage key operations is required. AC:H is used because successful triggering depends on winning a race with concurrent large page splitting. The issue is not directly network reachable, although a remotely controlled workload inside an existing guest could exercise the guest side path. The demonstrated impact is host denial of service. In the paranoid case, limited confidentiality and integrity impact is retained because an incorrect physical page storage key or reference state may be read or modified, but no UAF, OOB write, arbitrary memory write, or reliable privilege escalation primitive is established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.