UBUNTU-CVE-2026-98475: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schibconfig and schib fields as dma64t to enable automatic detection of incorrect assignments. Also add the missing virttodma64() translation. Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIGRANDOMIZEIDENTITYBASE=y.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Update the s390/cmf measurement block address handling so the absolute address is translated with virt_to_dma64(), and define the associated schib_config and schib fields as dma64_t to detect incorrect assignments.
Linux kernel s390/cmf virt_to_dma64() translation and schib_config/schib field types = Add the missing virt_to_dma64() translation and define the associated schib_config and schib fields as dma64_t
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue applies to Linux kernel systems using the s390 channel-measurement facility where the kernel is built with CONFIG_RANDOMIZE_IDENTITY_BASE=y. It affects handling of extended-format channel measurement data.
What conditions are required for the incorrect address to be used?
Firmware must be storing extended-format channel measurement data. On affected randomized-identity-base builds, the measurement block address can be passed as the wrong address type, causing firmware to use an incorrect address.
How can I determine whether a system needs attention?
Check whether the running or deployed kernel is built with CONFIG_RANDOMIZE_IDENTITY_BASE=y and whether the system uses s390 channel measurement functionality with extended-format measurement data. The provided information does not identify an affected default configuration.
What is the remediation described by the fix?
The fix changes the relevant schib_config and schib fields to dma64_t and adds the missing virt_to_dma64() translation, so the firmware receives the required absolute measurement-block address.