Live › vulnerability › CVE-2026-99126
Go to dashboardThe s390 CTCM channel-to-channel network driver in the Linux kernel can dereference a NULL pointer during XID validation when the peer XID is missing or read/write channel pairing mismatches. The sources describe a kernel null dereference, which typically leads to a crash or denial of service rather than code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only systems running the Linux kernel on IBM Z (s390) hardware that use the CTCM channel-to-channel network driver are exposed. Systems on x86, ARM or other architectures, and s390 hosts without the ctcm driver loaded, can skip it.
No product ranges from the sources yet.
uname -r to confirm the running kernel version, then compare against the fixed kernel release in the vendor advisorylsmod | grep ctcm on IBM Z (s390) systemsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
s390/ctcm: Prevent XID null dereference
The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->saved_xid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference.
Fix this by using the always available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 for validation errors.
This page as .md · .json · in your agent: get_signal("CVE-2026-99126")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.