VulnerabilityPublished 14 Oct 2026Updated 19 Oct 2026

CVE-2026-98400: Linux kernel · s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd, 92d0829eae257544b6b0faccb6e7079c45e22d48, 50f9c40768e84f30d374235b3ee3850a94d9ac29 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3b9678472bab86ae654cf2c18d5dd551558045be, < b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd	Fixed in b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd
LinuxLinux	Affected ≥ 3b9678472bab86ae654cf2c18d5dd551558045be, < 92d0829eae257544b6b0faccb6e7079c45e22d48	Fixed in 92d0829eae257544b6b0faccb6e7079c45e22d48
LinuxLinux	Affected ≥ 3b9678472bab86ae654cf2c18d5dd551558045be, < 50f9c40768e84f30d374235b3ee3850a94d9ac29	Fixed in 50f9c40768e84f30d374235b3ee3850a94d9ac29
LinuxLinux	Affected ≥ 3b9678472bab86ae654cf2c18d5dd551558045be, < 030e88812435fc5d6aa42eee41fa77b5ea620327	Fixed in 030e88812435fc5d6aa42eee41fa77b5ea620327
LinuxLinux	Affected ≥ 3b9678472bab86ae654cf2c18d5dd551558045be, < 7f918871112e8e7c581e99eb8e545af4e59c8367	Fixed in 7f918871112e8e7c581e99eb8e545af4e59c8367
LinuxLinux	Affected =4.17	Fixed in–

AI-suggested

A patch is available and has been applied in the Linux kernel. Systems running the affected version (=4.17) should update to a fixed kernel version containing the commits identified by the fixedVersions hashes. Since this is a kernel-level fix, applying the updated kernel is the recommended remediation.

Description

A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture IPL (Initial Program Load) handling was fixed. The issue occurs in kdump when no re-IPL parameter block is provided, leading to a NULL dereference in set_os_info_reipl_block(). This happens because the os_info update was made unconditional, causing a dereference of a NULL pointer for IPL_TYPE_UNKNOWN. The fix skips the os_info update when no re-IPL parameter block is available, allowing kdump to collect the dump and reboot safely.

Impact

The vulnerability can cause a kernel NULL pointer dereference during kdump operations on s390 systems when no re-IPL parameter block is provided. This could lead to a kernel crash or system instability during crash dump collection. There is no indication of remote exploitation or privilege escalation. The impact is limited to kernel crash dump handling on affected s390 IPL types.

Summary

The Linux kernel s390 IPL code had a vulnerability where certain IPL types, such as HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In these cases, reipl_block_actual remains NULL, but due to a commit that moved os_info updates to machine_crash_shutdown() unconditionally, set_os_info_reipl_block() dereferenced this NULL pointer. This could cause a kernel NULL pointer dereference during kdump operations. The patch modifies the code to skip the os_info update if no re-IPL parameter block is present, preventing the NULL dereference and ensuring safe crash dump collection and reboot.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:33 UTC

Technical details

References

Community reviews

Related threats