{"id":"CVE-2026-98651","kind":"vulnerability","aliases":["CVE-2026-98651"],"related":[],"title":"Linux kernel KVM s390: NULL pointer dereference in storage key handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()\n\nSome callers pass NULL as oldkey. Calling page_cond_set_storage_key()\nwill cause that NULL pointer to get dereferenced.\n\nFix by checking for NULL and assigning the pointer to a dummy local\nvariable to avoid crashes.","summary":"In the Linux kernel's KVM s390 code, some callers pass a NULL oldkey pointer to dat_cond_set_storage_key(), which is then dereferenced. The sources describe a crash from this bug; they do not describe code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-z","infrastructure","kvm","linux-kernel","s390"],"not_affected_if":["kvm-not-used","non-s390-architecture"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel in the NVD entry.\n- Check whether KVM s390 is in use on the host (IBM Z / LinuxONE systems running KVM guests).","fix":"- Update the Linux kernel to a release that includes the upstream fix for dat_cond_set_storage_key() (version unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:39+00:00","updated_at":"2026-10-25T05:19:39+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:19:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for dat_cond_set_storage_key() (version unknown from the sources).","reach":"local","title":"Linux kernel KVM s390: NULL pointer dereference in storage key handling","impact":"low","summary":"In the Linux kernel's KVM s390 code, some callers pass a NULL oldkey pointer to dat_cond_set_storage_key(), which is then dereferenced. The sources describe a crash from this bug; they do not describe code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","kvm","s390","ibm-z"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe a crash from a NULL dereference","analyst_note":"Check the NVD entry and the upstream kernel commit to confirm the fixed kernel version and whether a guest can trigger the NULL path.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel in the NVD entry.\n- Check whether KVM s390 is in use on the host (IBM Z / LinuxONE systems running KVM guests).","needs_analyst":true,"not_affected_if":["non-s390-architecture","kvm-not-used"],"who_is_affected":"Only hosts running the Linux kernel with KVM on IBM s390 hardware (IBM Z or LinuxONE) are in scope, since the flaw is in the s390-specific KVM code. Teams running x86, ARM or other architectures, or not using KVM on s390, can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":3355,"output_tokens":595,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98651':14A,17A 'assign':117C 'avoid':126C 'bug':59B 'call':97C 'caller':36B,92C 'caus':104C 'check':113C 'code':34B,64B 'cond':44B,87C,99C 'crash':56B,127C 'cve':12A,15A 'dat':43B,86C 'data':67B 'derefer':7A 'dereferenc':51B,110C 'describ':54B,63B 'dummi':122C 'execut':65B 'exposur':68B 'fix':111C 'follow':74C 'get':109C 'handl':11A,82C 'ibm':19B 'ibm-z':18B 'infrastructur':21B 'kernel':2A,25B,30B,72C 'key':10A,47B,90C,102C 'kvm':3A,22B,32B,79C 'linux':1A,24B,29B,71C 'linux-kernel':23B 'local':123C 'null':5A,39B,83C,94C,106C,115C 'oldkey':40B,96C 'page':98C 'pass':37B,93C 'pointer':6A,41B,84C,107C,119C 'proper':81C 'resolv':78C 's390':4A,26B,33B,80C 'set':45B,88C,100C 'sourc':53B 'storag':9A,46B,89C,101C 'variabl':124C 'vulner':75C 'z':20B","nicknames":[],"mitigations":[],"who_affected":"Only hosts running the Linux kernel with KVM on IBM s390 hardware (IBM Z or LinuxONE) are in scope, since the flaw is in the s390-specific KVM code. Teams running x86, ARM or other architectures, or not using KVM on s390, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98651","severity":null,"published_at":"2026-10-18T16:17:18+00:00","modified_at":"2026-10-19T10:19:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}