CVE-2026-98403 (GCVE-0-2026-98403)
Vulnerability from cvelistv5
Published
2026-10-14 13:26
Modified
2026-10-19 09:18
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to the IPL parameter conversion helpers and points the destination one byte past early_command_line. The helpers subtract one from the unsigned size and write the converted parameter outside the command line buffer. Convert the IPL parameter in the command line parsing buffer first. A parameter beginning with '=' can then replace the existing command line regardless of its length, while other parameters are appended only when space remains.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5ecb2da660ab8eddafe059a6a8a708465db89ca2
Version: 5ecb2da660ab8eddafe059a6a8a708465db89ca2
Version: 5ecb2da660ab8eddafe059a6a8a708465db89ca2
Version: 5ecb2da660ab8eddafe059a6a8a708465db89ca2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/ipl_parm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af9866021a00ab9eeacf0c33ee73f3d134b4ed70",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            },
            {
              "lessThan": "73eec5a0d55916d7e1115f5d03a7ffc06d6215cf",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            },
            {
              "lessThan": "8d11bfec8666f8409fac9072e9c25b691d3e30ac",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            },
            {
              "lessThan": "d76181dfabdaa720703167393704efacba343442",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/ipl_parm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/boot: Avoid IPL parameter append past command line\n\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\n\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with \u0027=\u0027 can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:56.682Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af9866021a00ab9eeacf0c33ee73f3d134b4ed70"
        },
        {
          "url": "https://git.kernel.org/stable/c/73eec5a0d55916d7e1115f5d03a7ffc06d6215cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d11bfec8666f8409fac9072e9c25b691d3e30ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"
        }
      ],
      "title": "s390/boot: Avoid IPL parameter append past command line",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98403",
    "datePublished": "2026-10-14T13:26:02.916Z",
    "dateReserved": "2026-09-25T10:25:14.347Z",
    "dateUpdated": "2026-10-19T09:18:56.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.