{"id":"CVE-2026-98475","kind":"vulnerability","aliases":["CVE-2026-98475"],"related":[],"title":"Linux kernel s390: channel measurement block uses wrong address type","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cmf: Fix virtual vs physical address confusion\n\nThe measurement block address is an absolute address. Define the\nassociated schib_config and schib fields as dma64_t to enable automatic\ndetection of incorrect assignments. Also add the missing virt_to_dma64()\ntranslation.\n\nWithout this fix, a wrong address will be used by firmware when storing\nextended format channel measurement data on kernels built with\nCONFIG_RANDOMIZE_IDENTITY_BASE=y.","summary":"On s390 Linux kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE, the channel measurement facility passes a virtual address where firmware expects an absolute address. Firmware then stores extended channel measurement data at the wrong location, which is a correctness bug rather than a clear attack path.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-z","infrastructure","linux-kernel","s390"],"not_affected_if":["kernel-without-randomize-identity-base","non-s390-architecture"],"how_to_check":"- Check whether the kernel is built with `CONFIG_RANDOMIZE_IDENTITY_BASE=y` in the kernel config, for example `grep RANDOMIZE_IDENTITY_BASE /boot/config-$(uname -r)`\n- Check whether the host is an IBM Z (s390x) system using channel measurement data, which the sources do not detail further","fix":"- Update the Linux kernel to a release that includes the upstream commit titled 's390/cmf: Fix virtual vs physical address confusion' (exact fixed version: unknown)","status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:57+00:00","updated_at":"2026-10-25T05:25:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit titled 's390/cmf: Fix virtual vs physical address confusion' (exact fixed version: unknown)","reach":"local","title":"Linux kernel s390: channel measurement block uses wrong address type","impact":"low","summary":"On s390 Linux kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE, the channel measurement facility passes a virtual address where firmware expects an absolute address. Firmware then stores extended channel measurement data at the wrong location, which is a correctness bug rather than a clear attack path.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","s390","ibm-z"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Firmware stores channel measurement data at a wrong address, causing data corruption","analyst_note":"Confirm the fixed kernel versions and whether the bug has any security impact beyond incorrect measurement data, using the NVD entry linked in the sources.","how_to_check":"- Check whether the kernel is built with `CONFIG_RANDOMIZE_IDENTITY_BASE=y` in the kernel config, for example `grep RANDOMIZE_IDENTITY_BASE /boot/config-$(uname -r)`\n- Check whether the host is an IBM Z (s390x) system using channel measurement data, which the sources do not detail further","needs_analyst":true,"not_affected_if":["non-s390-architecture","kernel-without-randomize-identity-base"],"who_is_affected":"Only s390 (IBM Z) Linux systems built with CONFIG_RANDOMIZE_IDENTITY_BASE=y are described as affected, where extended format channel measurement data may be stored incorrectly. Systems on other architectures or kernels without that option are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00068,"input_tokens":3396,"output_tokens":680,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98475':13A,16A 'absolut':47B,94C 'add':115C 'address':9A,42B,48B,86C,91C,95C,127C 'also':114C 'assign':113C 'associ':98C 'attack':69B 'automat':109C 'base':34B,147C 'block':6A,90C 'bug':64B 'built':29B,142C 'channel':4A,36B,53B,137C 'clear':68B 'config':31B,100C,144C 'confus':87C 'correct':63B 'cve':11A,14A 'data':55B,139C 'defin':96C 'detect':110C 'dma64':105C,120C 'enabl':108C 'expect':45B 'extend':52B,135C 'facil':38B 'field':103C 'firmwar':44B,49B,132C 'fix':82C,124C 'follow':76C 'format':136C 'ibm':18B 'ibm-z':17B 'ident':33B,146C 'incorrect':112C 'infrastructur':20B 'kernel':2A,23B,28B,74C,141C 'linux':1A,22B,27B,73C 'linux-kernel':21B 'locat':59B 'measur':5A,37B,54B,89C,138C 'miss':117C 'pass':39B 'path':70B 'physic':85C 'random':32B,145C 'rather':65B 'resolv':80C 's390':3A,24B,26B 's390/cmf':81C 'schib':99C,102C 'store':51B,134C 'translat':121C 'type':10A 'use':7A,130C 'virt':118C 'virtual':41B,83C 'vs':84C 'vulner':77C 'without':122C 'wrong':8A,58B,126C 'y':148C 'z':19B","nicknames":[],"mitigations":[],"who_affected":"Only s390 (IBM Z) Linux systems built with CONFIG_RANDOMIZE_IDENTITY_BASE=y are described as affected, where extended format channel measurement data may be stored incorrectly. Systems on other architectures or kernels without that option are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98475","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}