CVE-2026-98475 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/cmf: Fix virtual vs physical address confusion
The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also add the missing virt_to_dma64() translation.
Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel vulnerability identified in the s390 architecture involves a critical confusion between virtual and physical memory addresses within the Channel Measurement Facility (CMF) subsystem. This flaw specifically affects how the system handles extended format channel measurement data, which is essential for performance monitoring and diagnostics on IBM mainframe systems. The core technical issue stems from an incorrect assignment of address types where the measurement block address, defined as an absolute or physical location in hardware terms, was not properly translated to a virtual address suitable for kernel memory access when CONFIG_RANDOMIZE_IDENTITY_BASE is enabled. This configuration option introduces randomization into the identity mapping base, altering how addresses are interpreted by the kernel compared to static mappings. Consequently, without proper translation using virt_to_dma64(), the firmware receives an incorrect address pointer, leading to data being written to unintended memory locations or causing a system crash due to invalid memory access patterns during measurement collection operations.
From a security and reliability perspective, this vulnerability represents a classic case of improper input validation regarding memory addressing schemes, which can be categorized under CWE-120 Buffer Copy without Checking Size of Input in the context of incorrect pointer arithmetic, though more accurately it aligns with CWE-787 Out-of-bounds Write if the wrong address leads to writing outside allocated buffers. In terms of attack vectors and operational impact, this issue primarily affects system stability rather than providing a direct privilege escalation path for external attackers. However, in high-assurance environments such as those running on z/Architecture systems, memory corruption or kernel panics can lead to significant service disruptions. The ATT&CK framework does not have a specific entry for this type of internal kernel bug, but the operational impact resembles techniques associated with Denial of Service (T1499) due to potential system crashes. Furthermore, if an attacker could influence the measurement data or trigger specific conditions that exploit the memory corruption aspect, it might indirectly facilitate information disclosure through side-channel effects, although this is speculative and dependent on specific workload characteristics.
The resolution involves defining the associated schib_config and schib fields as dma64_t types to enable automatic detection of incorrect assignments during compilation and runtime checks. This type enforcement ensures that developers are alerted if there is a mismatch between expected physical/dma addresses and virtual kernel pointers. Additionally, the fix explicitly adds the missing virt_to_dma64() translation function call, ensuring that when CONFIG_RANDOMIZE_IDENTITY_BASE is active, the correct translated address is passed to the firmware for storing extended format channel measurement data. This correction guarantees that memory operations target valid, mapped regions of physical memory accessible by both the kernel and the hardware interface.
To mitigate this vulnerability in affected systems, administrators should ensure that their Linux kernels are updated to include the patch addressing s390/cmf address translation errors. For environments where CONFIG_RANDOMIZE_IDENTITY_BASE is enabled, which is common for enhanced security posture against certain memory corruption attacks, applying this fix is critical to maintain system stability and accurate performance monitoring capabilities. Regular kernel updates and adherence to vendor-specific guidance for IBM mainframe operating systems are recommended practices. Furthermore, developers working on s390 architecture components should rigorously test address translation logic under randomized identity base configurations to prevent similar issues in future code revisions. Monitoring system logs for unexpected crashes or measurement data anomalies can also serve as an early detection mechanism for residual impacts if the patch has not yet been applied.