{"id":"CVE-2026-98650","kind":"vulnerability","aliases":["CVE-2026-98650"],"related":[],"title":"Linux kernel s390 KVM: race while handling storage keys can crash host","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix potential races in dat skey functions\n\nWhen dat_cond_set_storage_key() finds a large page, it will\nconditionally set the storage key in absolute memory using\nlarge_crste_to_phys() to get the absolute address.\n\nThere is a race window between dat_entry_walk() and\nlarge_crste_to_phys(): the large page could have been split\nconcurrently, and large_crste_to_phys() might be called with a crste\nthat does not designate a large page, leading to crashes.\n\nSimilar issues were also present in dat_set_storage_key().\n\ndat_get_storage_key() and dat_reset_reference_bit() did instead check\nfor a potential concurrent splitting of the large page, but then\nhandled it incorrectly.\n\nFix by performing a READ_ONCE on the crste pointer, checking and using\nthe result, instead of dereferencing the pointer again. In case a race\nis detacted, try dat_entry_walk() again.","summary":"A race in the Linux kernel's s390 KVM storage-key code lets a large page be split concurrently, so a function may be called with a page-table entry that is not a large page, causing a crash. The sources describe the crash but do not state a confidentiality or code-execution impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kvm","linux-kernel","other","s390"],"not_affected_if":["kvm-not-in-use","non-s390-architecture"],"how_to_check":"- Check whether the host runs Linux on IBM s390 hardware with KVM enabled (`uname -m` reports `s390x`, and `/dev/kvm` exists).\n- Compare the running kernel with the fixed release listed in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98650); the fixed version is unknown from the sources.","fix":"- Update the Linux kernel to a release that includes the upstream fix for the s390 KVM dat storage-key races; the exact fixed version is unknown from the sources.\n- Reboot into the patched kernel after updating.","status":"open","published_at":"2026-10-18T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:40+00:00","updated_at":"2026-10-25T05:19:40+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:19:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for the s390 KVM dat storage-key races; the exact fixed version is unknown from the sources.\n- Reboot into the patched kernel after updating.","reach":"local","title":"Linux kernel s390 KVM: race while handling storage keys can crash host","impact":"low","summary":"A race in the Linux kernel's s390 KVM storage-key code lets a large page be split concurrently, so a function may be called with a page-table entry that is not a large page, causing a crash. The sources describe the crash but do not state a confidentiality or code-execution impact.","category":"other","nicknames":[],"who_cares":["linux-kernel","kvm","s390"],"confidence":0.5,"needs_auth":"unknown","worst_case":"host kernel crashes during concurrent storage-key handling","analyst_note":"Confirm the fixed kernel version and the attacker's required access from the NVD entry or the upstream kernel commit.","how_to_check":"- Check whether the host runs Linux on IBM s390 hardware with KVM enabled (`uname -m` reports `s390x`, and `/dev/kvm` exists).\n- Compare the running kernel with the fixed release listed in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98650); the fixed version is unknown from the sources.","needs_analyst":true,"not_affected_if":["non-s390-architecture","kvm-not-in-use"],"who_is_affected":"Only hosts running the Linux kernel on IBM s390 with KVM virtualization that use the storage-key functions are described by the sources. Systems on other architectures or without s390 KVM can skip it. The sources do not state the exact trigger conditions beyond concurrent large-page splitting.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":3536,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98650':15A,18A 'absolut':119C,129C 'address':130C 'also':177C 'bit':192C 'call':50B,160C 'case':232C 'caus':63B 'check':195C,220C 'code':37B,79B 'code-execut':78B 'concurr':44B,152C,199C 'cond':103C 'condit':113C 'confidenti':76B 'could':148C 'crash':11A,65B,70B,173C 'crste':123C,142C,155C,163C,218C 'cve':13A,16A 'dat':98C,102C,137C,180C,184C,189C,238C 'dereferenc':227C 'describ':68B 'design':167C 'detact':236C 'entri':56B,138C,239C 'execut':80B 'find':107C 'fix':94C,210C 'follow':87C 'function':47B,100C 'get':127C,185C 'handl':7A,207C 'host':12A 'impact':81B 'incorrect':209C 'instead':194C,225C 'issu':175C 'kernel':2A,22B,30B,85C 'key':9A,36B,106C,117C,183C,187C 'kvm':4A,19B,33B,92C 'larg':40B,61B,109C,122C,141C,146C,154C,169C,203C 'lead':171C 'let':38B 'linux':1A,21B,29B,84C 'linux-kernel':20B 'may':48B 'memori':120C 'might':158C 'page':41B,54B,62B,110C,147C,170C,204C 'page-t':53B 'perform':212C 'phys':125C,144C,157C 'pointer':219C,229C 'potenti':95C,198C 'present':178C 'race':5A,26B,96C,134C,234C 'read':214C 'refer':191C 'reset':190C 'resolv':91C 'result':224C 's390':3A,24B,32B,93C 'set':104C,114C,181C 'similar':174C 'skey':99C 'sourc':67B 'split':43B,151C,200C 'state':74B 'storag':8A,35B,105C,116C,182C,186C 'storage-key':34B 'tabl':55B 'tri':237C 'use':121C,222C 'vulner':88C 'walk':139C,240C 'window':135C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running the Linux kernel on IBM s390 with KVM virtualization that use the storage-key functions are described by the sources. Systems on other architectures or without s390 KVM can skip it. The sources do not state the exact trigger conditions beyond concurrent large-page splitting.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98650","severity":null,"published_at":"2026-10-18T16:17:18+00:00","modified_at":"2026-10-19T10:19:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}