CVE-2026-98403: s390/boot: Avoid IPL parameter append past command line
In the Linux kernel, the following vulnerability has been resolved:
s390/boot: Avoid IPL parameter append past command line
A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm() passes a zero size to the IPL parameter conversion helpers and points the destination one byte past earlycommandline. The helpers subtract one from the unsigned size and write the converted parameter outside the command line buffer.
Convert the IPL parameter in the command line parsing buffer first. A parameter beginning with '=' can then replace the existing command line regardless of its length, while other parameters are appended only when space remains.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is in the Linux kernel s390 boot path, specifically handling IPL parameters while building the early command line. Systems not using the affected s390 IPL boot handling are not described as exposed by the provided information.
What conditions are required to trigger the out-of-bounds write?
The existing command line must occupy all but its terminating byte in COMMAND_LINE_SIZE, and IPL parameter processing must then attempt to append a parameter. This causes a zero-size buffer to be passed to conversion helpers with a destination positioned one byte past early_command_line.
How does the resolved behavior handle IPL parameters when command-line space is exhausted?
The IPL parameter is converted in the command-line parsing buffer first. A parameter beginning with '=' may replace the existing command line regardless of length, while other parameters are appended only when space remains.