Live › vulnerability › CVE-2026-98475
Go to dashboardOn s390 Linux kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE, the channel measurement facility passes a virtual address where firmware expects an absolute address. Firmware then stores extended channel measurement data at the wrong location, which is a correctness bug rather than a clear attack path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only s390 (IBM Z) Linux systems built with CONFIG_RANDOMIZE_IDENTITY_BASE=y are described as affected, where extended format channel measurement data may be stored incorrectly. Systems on other architectures or kernels without that option are not described as affected.
No product ranges from the sources yet.
CONFIG_RANDOMIZE_IDENTITY_BASE=y in the kernel config, for example grep RANDOMIZE_IDENTITY_BASE /boot/config-$(uname -r)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
s390/cmf: Fix virtual vs physical address confusion
The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also add the missing virt_to_dma64() translation.
Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y.
This page as .md · .json · in your agent: get_signal("CVE-2026-98475")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.