Live › vulnerability › CVE-2026-98648
Go to dashboardOn IBM s390 Linux systems with more than 85 Ultravisor secrets, the lookup code in find_secret_in_page reads past the end of a page when the target secret is on the next page or absent. The fix bounds the loop to the number of secrets stored in each sub-list.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only IBM s390 Linux hosts that use the Ultravisor secret store with more than 85 secrets are plausibly affected. The sources do not say which kernel versions are fixed, so check the kernel stable advisory. Systems on other architectures can skip it.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
s390/uv: Prevent potential out-of-bounds read
When the system has more than 85 secrets, the uv_secret_list struct array only holds up to 85 items per page, resulting in an out of bounds read in find_secret_in_page if the targeted secret is in the next page or not stored at all.
Fix this by looping over the number of stored secrets which is the per sub-list count of stored secrets and not the overall count.
This page as .md · .json · in your agent: get_signal("CVE-2026-98648")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.