Live › vulnerability › CVE-2026-98651
Go to dashboardIn the Linux kernel's KVM s390 code, some callers pass a NULL oldkey pointer to dat_cond_set_storage_key(), which is then dereferenced. The sources describe a crash from this bug; they do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hosts running the Linux kernel with KVM on IBM s390 hardware (IBM Z or LinuxONE) are in scope, since the flaw is in the s390-specific KVM code. Teams running x86, ARM or other architectures, or not using KVM on s390, can skip it.
No product ranges from the sources yet.
uname -r and compare it against the fixed kernel in the NVD entry.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()
Some callers pass NULL as oldkey. Calling page_cond_set_storage_key() will cause that NULL pointer to get dereferenced.
Fix by checking for NULL and assigning the pointer to a dummy local variable to avoid crashes.
This page as .md · .json · in your agent: get_signal("CVE-2026-98651")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.