–
Not scored
CVE-2026-99126
s390/ctcm: Prevent XID null dereference
LinuxAffectedLinux, Linux
FixUpdate to 977dac6cc5531a8e058df05b6af94406b940cb9e, 1525fb6e2f9f9a2c8c8723ee0959b1130a6b8213, 34fa3607b7604b3052b19cec8b0ad644818cdd2a, 8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeab or newer
PublishedOct 28, 10:34 · Linux
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->saved_xid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference. Fix this by using the always available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 for validation errors.
From Linux
Affected and fixed versions
ProductAffectedFixed inLinux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before f9d9e2dadc9fbdfe01aeb6581978c3b59092919e–Linux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before a7c3e1795e4fe5e6680cab7cd7eee0503b00a248–Linux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before c11e435d334e4c311eaaf721e179a5ca6852c221–Linux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before 977dac6cc5531a8e058df05b6af94406b940cb9e977dac6cc5531a8e058df05b6af94406b940cb9eLinux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before 1525fb6e2f9f9a2c8c8723ee0959b1130a6b82131525fb6e2f9f9a2c8c8723ee0959b1130a6b8213Linux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before 34fa3607b7604b3052b19cec8b0ad644818cdd2a34fa3607b7604b3052b19cec8b0ad644818cdd2aLinux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before 8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeab8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeabLinux293d984f0e3604c04dcdbf00117ddc1e5d4b1909 – before b264d8422779d69febce914efc47a92a85cc382c–Linux2.6.26–LinuxNot affected0LinuxNot affected5.10.273LinuxNot affected5.15.224LinuxNot affected6.1.191LinuxNot affected6.6.161LinuxNot affected6.12.115LinuxNot affected6.18.59LinuxNot affected7.2.13LinuxNot affected7.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known