{"id":"CVE-2026-98648","kind":"vulnerability","aliases":["CVE-2026-98648"],"related":[],"title":"Linux s390 kernel: out-of-bounds read when many UV secrets stored","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/uv: Prevent potential out-of-bounds read\n\nWhen the system has more than 85 secrets, the uv_secret_list struct\narray only holds up to 85 items per page, resulting in an out of bounds\nread in find_secret_in_page if the targeted secret is in the next page\nor not stored at all.\n\nFix this by looping over the number of stored secrets which is the\nper sub-list count of stored secrets and not the overall count.","summary":"On IBM s390 Linux systems with more than 85 Ultravisor secrets, the lookup code in find_secret_in_page reads past the end of a page when the target secret is on the next page or absent. The fix bounds the loop to the number of secrets stored in each sub-list.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-z","linux-kernel","runtime","s390"],"not_affected_if":["non-s390-architecture"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:49+00:00","updated_at":"2026-10-25T05:20:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:20:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux s390 kernel: out-of-bounds read when many UV secrets stored","impact":"low","summary":"On IBM s390 Linux systems with more than 85 Ultravisor secrets, the lookup code in find_secret_in_page reads past the end of a page when the target secret is on the next page or absent. The fix bounds the loop to the number of secrets stored in each sub-list.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","s390","ibm-z"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel reads out of bounds memory during secret lookup, possibly crashing.","analyst_note":"Find the fixed kernel versions and confirm whether an unprivileged user can trigger the lookup, using the kernel.org stable commit for this CVE.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-s390-architecture"],"who_is_affected":"Only IBM s390 Linux hosts that use the Ultravisor secret store with more than 85 secrets are plausibly affected. The sources do not say which kernel versions are fixed, so check the kernel stable advisory. Systems on other architectures can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000571,"input_tokens":3377,"output_tokens":467,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98648':16A,19A '85':36B,105C,117C 'absent':64B 'array':112C 'bound':7A,67B,97C,126C 'code':41B 'count':164C,172C 'cve':14A,17A 'end':50B 'find':43B,129C 'fix':66B,147C 'follow':86C 'hold':114C 'ibm':21B,29B 'ibm-z':20B 'item':118C 'kernel':3A,25B,84C 'linux':1A,24B,31B,83C 'linux-kernel':23B 'list':80B,110C,163C 'lookup':40B 'loop':69B,150C 'mani':10A 'next':61B,140C 'number':72B,153C 'out-of-bound':4A,94C 'overal':171C 'page':46B,53B,62B,120C,132C,141C 'past':48B 'per':119C,160C 'potenti':93C 'prevent':92C 'read':8A,47B,98C,127C 'resolv':90C 'result':121C 'runtim':26B 's390':2A,27B,30B 's390/uv':91C 'secret':12A,38B,44B,57B,74B,106C,109C,130C,136C,156C,167C 'store':13A,75B,144C,155C,166C 'struct':111C 'sub':79B,162C 'sub-list':78B,161C 'system':32B,101C 'target':56B,135C 'ultravisor':37B 'uv':11A,108C 'vulner':87C 'z':22B","nicknames":[],"mitigations":[],"who_affected":"Only IBM s390 Linux hosts that use the Ultravisor secret store with more than 85 secrets are plausibly affected. The sources do not say which kernel versions are fixed, so check the kernel stable advisory. Systems on other architectures can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98648","severity":null,"published_at":"2026-10-18T16:17:18+00:00","modified_at":"2026-10-19T10:19:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}