Cloudanix VulnDB

CVE-2026-99126

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel on IBM mainframes could make the system crash when handling certain network messages over specialized connections.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in s390/ctcm mpc_validate_xid when grp->saved_xid2 is uninitialized on peer XID NULL or r/w channel pairing mismatch, during attempt to set xid2_flag2 on validation error.

Why it matters to the business

Kernel crashes on affected s390 systems using ctcm networking can interrupt channel-to-channel connectivity and cause denial of service until reboot.

How an attack unfolds

An attacker with network access to a ctcm interface sends crafted XID frames or forces pairing mismatch conditions to reach the error path that dereferences an uninitialized saved_xid2 pointer.

How to fix it

Apply the upstream Linux kernel fix that changes error flag assignment to use the always-initialized priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2.

How to confirm the fix worked

Inspect mpc_validate_xid source for the priv->xid usage pattern; attempt to reproduce XID error conditions in a test environment and confirm absence of NULL dereference oops.

Typical attack path

  1. Gain access to ctcm-enabled s390 networking path
  2. Send XID frames that trigger validation error with NULL peer XID or pairing mismatch
  3. Force execution of uninitialized grp->saved_xid2 access
  4. Trigger kernel NULL dereference and panic

How to detect it

Search kernel logs and oops reports for ctcm, mpc_validate_xid, and NULL dereference indicators; correlate with XID traffic on channel devices.

What your security team should do

  • Prioritize kernel update for s390 systems that enable ctcm
  • Review ctcm usage in mainframe networking configurations
  • Monitor kernel logs for ctcm-related panics until patched

The record

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->saved_xid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference. Fix this by using the always available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 for validation errors.

Affected packages

Ecosystem Package Introduced Fixed