Cloudanix VulnDB

CVE-2026-98475

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux kernel bug on certain mainframe computers could let firmware write data to the wrong place in memory when a specific setting is turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Virtual address used instead of absolute (DMA) address for measurement block passed to firmware; triggers on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y, causing firmware to store extended-format channel measurement data at an incorrect memory location.

Why it matters to the business

On s390 systems running affected kernels, channel measurement facility may corrupt memory or produce invalid data; risk is limited to niche mainframe deployments and specific kernel configuration, with no known active exploitation.

How an attack unfolds

An attacker with local access on an s390 system enables or triggers channel measurement operations; the kernel passes an untranslated virtual address, firmware writes measurement data to the wrong absolute address, resulting in memory corruption that can be leveraged for denial of service or further exploitation.

How to fix it

Apply the upstream fix that changes schib_config and schib fields to dma64_t and adds virt_to_dma64() translation; rebuild and boot kernels with the corrected s390/cmf code.

How to confirm the fix worked

Verify kernel source contains the dma64_t typedef usage and virt_to_dma64() call in s390 cmf paths; confirm CONFIG_RANDOMIZE_IDENTITY_BASE kernels no longer pass virtual addresses for measurement blocks; test channel measurement functionality post-upgrade.

Typical attack path

  1. Obtain local code execution on s390 Linux host
  2. Enable or exercise the channel measurement facility (cmf)
  3. Kernel supplies virtual address instead of dma64 absolute address to firmware
  4. Firmware stores data at incorrect memory location
  5. Resulting corruption leads to crash or attacker-controlled memory write

How to detect it

Review dmesg and kernel logs for address-related faults during channel measurement initialization; correlate with s390 cmf activity; no public exploit artifacts exist to hunt for.

What your security team should do

  • Prioritize patching s390 systems within standard change windows given low EPSS and absence from KEV
  • Audit kernel configs for CONFIG_RANDOMIZE_IDENTITY_BASE on mainframe hosts
  • Monitor for unusual s390 channel measurement related oops or firmware errors

The record

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also add the missing virt_to_dma64() translation. Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y.

Affected packages

Ecosystem Package Introduced Fixed