CVE-2026-98651: KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Properly handle NULL pointer in datcondsetstoragekey()
Some callers pass NULL as oldkey. Calling pagecondsetstoragekey() will cause that NULL pointer to get dereferenced.
Fix by checking for NULL and assigning the pointer to a dummy local variable to avoid crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In dat_cond_set_storage_key(), check whether oldkey is NULL and assign the pointer to a dummy local variable before dereferencing it, preventing NULL-pointer crashes.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue affects the Linux kernel's KVM implementation for s390. It is relevant where the affected KVM s390 code path can invoke dat_cond_set_storage_key() with a NULL oldkey argument.
What is the observable impact if the vulnerable path is reached?
A NULL pointer can be dereferenced by page_cond_set_storage_key(), causing a kernel crash.
What should be done if patching cannot happen immediately?
The provided information does not describe a configuration workaround. Reducing use of the affected KVM s390 functionality until the fix is applied may limit exposure, but no specific mitigation is documented.