CVE-2026-98475s390/cmf: Fix virtual vs physical address confusion
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also add the missing virt_to_dma64() translation. Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 14edd0d73bfef320fd5be11495687ba537aa6341 before b11f369be31ea11c746833e4d3ad51dcd6b5fa2b; from 14edd0d73bfef320fd5be11495687ba537aa6341 before 748ec2f7f5df9b4fc742546a8bfc8aa5d847353e; 14edd0d73bfef320fd5be11495687ba537aa6341 builds before 7f78226eb743b362f52b212d7763801642539d1c; from 14edd0d73bfef320fd5be11495687ba537aa6341 before f4d04425e66af2ecee9d1a49ae0484436f3c2fd1 | CNA record |
References
- https://git.kernel.org/stable/c/b11f369be31ea11c746833e4d3ad51dcd6b5fa2b
- https://git.kernel.org/stable/c/748ec2f7f5df9b4fc742546a8bfc8aa5d847353e
- https://git.kernel.org/stable/c/7f78226eb743b362f52b212d7763801642539d1c
- https://git.kernel.org/stable/c/f4d04425e66af2ecee9d1a49ae0484436f3c2fd1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.