Live › vulnerability › CVE-2026-98650
Go to dashboardA race in the Linux kernel's s390 KVM storage-key code lets a large page be split concurrently, so a function may be called with a page-table entry that is not a large page, causing a crash. The sources describe the crash but do not state a confidentiality or code-execution impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hosts running the Linux kernel on IBM s390 with KVM virtualization that use the storage-key functions are described by the sources. Systems on other architectures or without s390 KVM can skip it. The sources do not state the exact trigger conditions beyond concurrent large-page splitting.
No product ranges from the sources yet.
uname -m reports s390x, and /dev/kvm exists).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix potential races in dat skey functions
When dat_cond_set_storage_key() finds a large page, it will conditionally set the storage key in absolute memory using large_crste_to_phys() to get the absolute address.
There is a race window between dat_entry_walk() and large_crste_to_phys(): the large page could have been split concurrently, and large_crste_to_phys() might be called with a crste that does not designate a large page, leading to crashes.
Similar issues were also present in dat_set_storage_key().
dat_get_storage_key() and dat_reset_reference_bit() did instead check for a potential concurrent splitting of the large page, but then handled it incorrectly.
Fix by performing a READ_ONCE on the crste pointer, checking and using the result, instead of dereferencing the pointer again. In case a race is detacted, try dat_entry_walk() again.
This page as .md · .json · in your agent: get_signal("CVE-2026-98650")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.