CVE-2026-98399: s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
In the Linux kernel, the following vulnerability has been resolved:
s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block
Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore.
Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case reipltypeinit() selects IPLTYPEUNKNOWN and reiplblockactual remains NULL. Nevertheless, dumpreiplrun() unconditionally dereferences it when preparing the lowcore fields. This may happen to work by chance when address zero contains readable lowcore data. A zero IPL parameter block address is then stored in lowcore, causing the stand-alone dumper to enter disabled wait after completing the dump.
Explicitly store a zero IPL parameter block address and checksum when no re-IPL parameter block is available. This does not change the behavior: the stand-alone dumper completes the dump and halts, while valid re-IPL parameter blocks continue to be handled as before.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems on s390 that use stand-alone dumping and boot through an IPL type that does not supply an IPL parameter block. Examples identified are HMC FTP boot and QEMU direct kernel boot.
What conditions are required to trigger the failure?
A stand-alone dump must run when no re-IPL parameter block is available. Under those conditions, the re-IPL block remains NULL, but the dump path dereferences it while preparing lowcore fields.
What is the operational impact if the issue occurs?
The stand-alone dumper can complete the dump and then enter disabled wait rather than re-IPL. The faulty dereference may appear to work accidentally if address zero contains readable lowcore data.
What should operators expect after applying the fix?
When no re-IPL parameter block exists, the kernel explicitly records zero for its address and checksum. The stand-alone dumper still completes the dump and halts, while systems with valid re-IPL parameter blocks retain their existing behavior.