CVE-2026-98649: KVM: s390: Fix race in _destroy_pages_crste()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix race in destroypagescrste()
Use READONCE() in destroypagescrste() to read the crste, avoid dereferencing the pointer multiple times.
Affected Software
1 affected component
Linux Linux kernel
Event History
Oct 18, 2026
CVE Published
via MITRE·03:20 PM
Data Sourced
via MITRE·03:20 PM
Description
Data Sourced
via NVD·04:17 PM
Description
Frequently Asked Questions
1
Which systems are exposed to this race condition?
The issue is in the Linux kernel's KVM support for s390. Systems not using that KVM s390 code path are not indicated as affected by the provided information.
2
What is the available remediation?
The vulnerability is described as resolved by changing _destroy_pages_crste() to use READ_ONCE() when reading crste, preventing multiple dereferences of the pointer. The provided stable kernel references identify commits containing the fix.