UBUNTU-CVE-2026-98648: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secret is in the next page or not stored at all. Fix this by looping over the number of stored secrets which is the per sub-list count of stored secrets and not the overall count.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update find_secret_in_page to loop over the number of stored secrets in each sub-list (the per-sub-list count), rather than the overall count of stored secrets, to prevent out-of-bounds reads when more than 85 secrets span multiple pages or the target secret is absent.
Event History
Frequently Asked Questions
Which deployments are most likely to encounter this issue?
The issue is relevant when the system has more than 85 secrets and a lookup targets a secret on a subsequent page or a secret that is not present. The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What level of access does an attacker need?
The supplied severity vector indicates local attack access, low privileges, no user interaction, and additional attack preconditions. The data does not specify the exact interface or operation needed to initiate a secret lookup.
What can be done if the fix cannot be deployed immediately?
Avoid configurations with more than 85 secrets where possible. The out-of-bounds read condition is described as occurring when the secret count exceeds the 85-item per-page capacity.