{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98403", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.347Z", "datePublished": "2026-10-14T13:26:02.916Z", "dateUpdated": "2026-10-14T13:26:02.916Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-14T13:26:02.916Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/boot: Avoid IPL parameter append past command line\n\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\n\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with '=' can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/boot/ipl_parm.c"], "versions": [{"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "lessThan": "af9866021a00ab9eeacf0c33ee73f3d134b4ed70", "status": "affected", "versionType": "git"}, {"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "lessThan": "73eec5a0d55916d7e1115f5d03a7ffc06d6215cf", "status": "affected", "versionType": "git"}, {"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "lessThan": "8d11bfec8666f8409fac9072e9c25b691d3e30ac", "status": "affected", "versionType": "git"}, {"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "lessThan": "d76181dfabdaa720703167393704efacba343442", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/boot/ipl_parm.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.3-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/af9866021a00ab9eeacf0c33ee73f3d134b4ed70"}, {"url": "https://git.kernel.org/stable/c/73eec5a0d55916d7e1115f5d03a7ffc06d6215cf"}, {"url": "https://git.kernel.org/stable/c/8d11bfec8666f8409fac9072e9c25b691d3e30ac"}, {"url": "https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"}], "title": "s390/boot: Avoid IPL parameter append past command line", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/s390/boot/ipl_parm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "af9866021a00ab9eeacf0c33ee73f3d134b4ed70", "status": "affected", "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "versionType": "git"}, {"lessThan": "73eec5a0d55916d7e1115f5d03a7ffc06d6215cf", "status": "affected", "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "versionType": "git"}, {"lessThan": "8d11bfec8666f8409fac9072e9c25b691d3e30ac", "status": "affected", "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "versionType": "git"}, {"lessThan": "d76181dfabdaa720703167393704efacba343442", "status": "affected", "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/s390/boot/ipl_parm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/boot: Avoid IPL parameter append past command line\n\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\n\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with '=' can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains."}], "id": "CVE-2026-98403", "lastModified": "2026-10-14T14:17:51.383", "metrics": {}, "published": "2026-10-14T14:17:51.383", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/73eec5a0d55916d7e1115f5d03a7ffc06d6215cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d11bfec8666f8409fac9072e9c25b691d3e30ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af9866021a00ab9eeacf0c33ee73f3d134b4ed70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/boot: Avoid IPL parameter append past command line", "id": "2552209", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552209"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/boot: Avoid IPL parameter append past command line\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with '=' can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains.", "A flaw was found in the Linux kernel's s390 boot code. This flaw can lead to a Denial of Service (DoS) through memory corruption during system startup. When the early boot command-line buffer is nearly full, appending Initial Program Load (IPL) parameters triggers an integer underflow, causing an out-of-bounds write outside the designated buffer. A user capable of specifying custom boot parameters can exploit this vulnerability during system initialization to crash the system."], "name": "CVE-2026-98403", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98403\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98403\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98403.mbox"], "threat_severity": "Moderate"}

{"created": "2026-10-15T04:45:13.067217+00:00", "updated": "2026-10-15T23:15:16.950313+00:00", "vendors": []}