CVE-2026-98403

What it actually does

Out-of-bounds write of one byte past the early_command_line buffer in append_ipl_block_parm() when a command line occupies all but the final byte of COMMAND_LINE_SIZE, caused by passing zero size to conversion helpers that then decrement an unsigned size value.

Why it matters to the business

Kernel memory corruption or boot-time crashes limited to IBM Z (s390) Linux systems; low likelihood of widespread operational impact given the architecture-specific boot path and absence from known exploitation lists.

How an attack unfolds

An attacker with the ability to supply a full-length kernel command line and trigger IPL block parameter appending (typically during controlled boot on s390 hardware) causes the conversion helpers to write outside the buffer; no public exploits or named threat actors are associated with this issue.

How to fix it

Update the Linux kernel to a version containing the upstream fix that converts the IPL parameter inside the command-line parsing buffer before any append operation.

How to confirm the fix worked

Confirm the kernel source contains the commit titled 's390/boot: Avoid IPL parameter append past command line' and that early_command_line writes are now bounded before the final byte.

Typical attack path

1. Supply a command line of exactly COMMAND_LINE_SIZE-1 bytes during s390 boot
2. Trigger append_ipl_block_parm() with an IPL parameter block
3. Cause conversion helper to receive zero remaining size and perform out-of-bounds write one byte past the buffer

How to detect it

Review kernel boot logs and dmesg for buffer-related warnings or oops on s390 systems; examine early boot command-line handling artifacts if a crash dump is available.

What your security team should do

• Prioritize patching s390-based Linux systems within normal change windows given low EPSS and no KEV listing
• Monitor upstream stable kernel releases for the referenced commit
• Restrict untrusted boot parameter sources on IBM Z hardware