In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key() Some… (CVE-2026-98651)

The Linux kernel's KVM module for s390 had a vulnerability where some callers passed a NULL pointer as oldkey to the function page_cond_set_storage_key(). This caused a NULL pointer dereference due to lack of proper NULL checking in dat_cond_set_storage_key(). The fix involved adding a check for NULL and using a dummy local variable to avoid dereferencing NULL pointers, thereby preventing potential kernel crashes.

The vulnerability could cause kernel crashes due to NULL pointer dereference in the KVM s390 code path. There is no indication of code execution or privilege escalation. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to properly handle NULL pointers in dat_cond_set_storage_key(). Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.