CVE-2026-98648: s390/uv: Prevent potential out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved:
s390/uv: Prevent potential out-of-bounds read
When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secret is in the next page or not stored at all.
Fix this by looping over the number of stored secrets which is the per sub-list count of stored secrets and not the overall count.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel s390/uv secret-list functionality are exposed when they manage more than 85 secrets. The out-of-bounds read can occur when the requested secret is located on a subsequent page or is not present.
What condition triggers the out-of-bounds read?
The vulnerable lookup uses the overall secret count while searching a single page that holds at most 85 secret entries. A lookup beyond that page's stored entries can read outside the array.
How can this be mitigated if an update cannot be applied immediately?
Keep the number of secrets at 85 or fewer to avoid crossing the per-page entry limit described for the vulnerable path.