UBUNTU-CVE-2026-99126: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpcvalidatexid() function sets grp->savedxid2->xid2flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->savedxid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference. Fix this by using the always available priv->xid->xid2flag2 instead of grp->savedxid2->xid2flag2 for validation errors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In mpc_validate_xid(), use the always-available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 when setting the 0x40 XID validation-error flag, because grp->saved_xid2 may be uninitialized when the peer XID is NULL or channel pairing mismatches.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the affected Ubuntu Linux kernel packages are in scope, including linux, linux-fips, linux-aws, linux-azure, linux-aws-fips, linux-azure-fips, linux-gcp, and linux-gcp-fips. The vulnerable code is in the s390 CTCM driver, so exposure depends on use of that driver and its channel configuration.
What condition triggers the null dereference?
The failure can occur during XID validation when the peer XID is NULL or when there is a read/write channel pairing mismatch. In those cases, grp->saved_xid2 may not have been initialized before the driver attempts to set its validation-error flag.
How can an administrator determine whether a system may be affected?
Check whether the running kernel is one of the listed Ubuntu kernel package families and whether the s390 CTCM driver is used. Also investigate CTCM connection or channel-pairing failures, particularly events involving a missing peer XID or mismatched read/write channels.