{"id":"CVE-2026-98650","revision":"72ed61aceafc40c28eeb9f5c6c80a6b7","records":[{"revision":"72ed61aceafc40c28eeb9f5c6c80a6b7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98650","aliases":[],"title":"KVM: s390: Fix potential races in dat skey functions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix potential races in dat skey functions\n\nWhen dat_cond_set_storage_key() finds a large page, it will\nconditionally set the storage key in absolute memory using\nlarge_crste_to_phys() to get the absolute address.\n\nThere is a race window between dat_entry_walk() and\nlarge_crste_to_phys(): the large page could have been split\nconcurrently, and large_crste_to_phys() might be called with a crste\nthat does not designate a large page, leading to crashes.\n\nSimilar issues were also present in dat_set_storage_key().\n\ndat_get_storage_key() and dat_reset_reference_bit() did instead check\nfor a potential concurrent splitting of the large page, but then\nhandled it incorrectly.\n\nFix by performing a READ_ONCE on the crste pointer, checking and using\nthe result, instead of dereferencing the pointer again. In case a race\nis detacted, try dat_entry_walk() again.","state":0,"publishedAt":"2026-10-18T15:20:22.173+00:00","modifiedAt":"2026-10-19T09:23:19.769+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/s390/kvm/gmap/dat.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8e03e8316eb242af307d1c789d09f1a1457cf9a3\",\n                            \"lessThan\": \"c958f0498891203fddf2764b28f8b102c6bfd719\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8e03e8316eb242af307d1c789d09f1a1457cf9a3\",\n                            \"lessThan\": \"27554b9505ddfc0aeab466aeb60929dfa17284c7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/s390/kvm/gmap/dat.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c958f0498891203fddf2764b28f8b102c6bfd719","https://git.kernel.org/stable/c/27554b9505ddfc0aeab466aeb60929dfa17284c7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98650","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98650","identifiers":["CVE-2026-98650"]},"retained":false,"historicalAffected":[]}],"coverage":[]}