{"id":"CVE-2026-98649","kind":"vulnerability","aliases":["CVE-2026-98649"],"related":[],"title":"Linux kernel KVM s390: race when destroying page table entries","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix race in _destroy_pages_crste()\n\nUse READ_ONCE() in _destroy_pages_crste() to read the crste, avoid\ndereferencing the pointer multiple times.","summary":"The Linux kernel's KVM s390 code could read a page table entry through a pointer several times during teardown, which allowed a race. The sources do not state what an attacker gains from the race.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kvm","linux-kernel","s390x","self-hosted"],"not_affected_if":["no-kvm","non-s390x-hardware"],"how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed release in the kernel stable tree.\n- Confirm the host runs KVM on IBM Z (s390x) hardware, for example with `lsmod | grep kvm`.","fix":"- Update the Linux kernel to a release that includes the upstream fix for _destroy_pages_crste() (version unknown from sources).\n- Reboot into the updated kernel.","status":"open","published_at":"2026-10-18T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:40+00:00","updated_at":"2026-10-25T05:19:40+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-10-25T05:19:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for _destroy_pages_crste() (version unknown from sources).\n- Reboot into the updated kernel.","reach":"local","title":"Linux kernel KVM s390: race when destroying page table entries","impact":"low","summary":"The Linux kernel's KVM s390 code could read a page table entry through a pointer several times during teardown, which allowed a race. The sources do not state what an attacker gains from the race.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","kvm","s390x","self-hosted"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; the sources only describe a read race in page teardown","analyst_note":"Find the upstream kernel commit for _destroy_pages_crste() and the affected and fixed kernel version ranges.","how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed release in the kernel stable tree.\n- Confirm the host runs KVM on IBM Z (s390x) hardware, for example with `lsmod | grep kvm`.","needs_analyst":true,"not_affected_if":["non-s390x-hardware","no-kvm"],"who_is_affected":"Only hosts running KVM virtualization on IBM Z (s390x) are relevant, since the flaw is in the s390 KVM code. Systems on x86, ARM or other architectures are not affected. The sources do not describe the exact trigger or required privileges.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":3311,"output_tokens":560,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98649':13A,16A 'allow':47B 'attack':57B 'avoid':91C 'code':32B 'could':33B 'crste':79C,86C,90C 'cve':11A,14A 'dereferenc':92C 'destroy':7A,77C,84C 'entri':10A,38B 'fix':74C 'follow':67C 'gain':58B 'host':25B 'infrastructur':17B 'kernel':2A,21B,28B,65C 'kvm':3A,18B,30B,72C 'linux':1A,20B,27B,64C 'linux-kernel':19B 'multipl':95C 'page':8A,36B,78C,85C 'pointer':41B,94C 'race':5A,49B,61B,75C 'read':34B,81C,88C 'resolv':71C 's390':4A,31B,73C 's390x':22B 'self':24B 'self-host':23B 'sever':42B 'sourc':51B 'state':54B 'tabl':9A,37B 'teardown':45B 'time':43B,96C 'use':80C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running KVM virtualization on IBM Z (s390x) are relevant, since the flaw is in the s390 KVM code. Systems on x86, ARM or other architectures are not affected. The sources do not describe the exact trigger or required privileges.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98649","severity":null,"published_at":"2026-10-18T16:17:18+00:00","modified_at":"2026-10-19T10:19:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}