CVE-2026-98650

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix potential races in dat skey functions

When dat_cond_set_storage_key() finds a large page, it will

conditionally set the storage key in absolute memory using

large_crste_to_phys() to get the absolute address.

There is a race window between dat_entry_walk() and

large_crste_to_phys(): the large page could have been split

concurrently, and large_crste_to_phys() might be called with a crste

that does not designate a large page, leading to crashes.

Similar issues were also present in dat_set_storage_key().

dat_get_storage_key() and dat_reset_reference_bit() did instead check

for a potential concurrent splitting of the large page, but then

handled it incorrectly.

Fix by performing a READ_ONCE on the crste pointer, checking and using

the result, instead of dereferencing the pointer again. In case a race

is detacted, try dat_entry_walk() again.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References