{"id":"CVE-2026-98650","title":"KVM: s390: Fix potential races in dat skey functions","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix potential races in dat skey functions\n\nWhen dat_cond_set_storage_key() finds a large page, it will\nconditionally set the storage key in absolute memory u…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8e03e8316eb242af307d1c789d09f1a1457cf9a3 < c958f0498891203fddf2764b28f8b102c6bfd719","Linux >= 8e03e8316eb242af307d1c789d09f1a1457cf9a3 < 27554b9505ddfc0aeab466aeb60929dfa17284c7","Linux 7.0"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:20:22.173Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98650","references":[{"url":"https://git.kernel.org/stable/c/c958f0498891203fddf2764b28f8b102c6bfd719"},{"url":"https://git.kernel.org/stable/c/27554b9505ddfc0aeab466aeb60929dfa17284c7"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.227Z","slug":"CVE-2026-98650","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix potential races in dat skey functions\n\nWhen dat_cond_set_storage_key() finds a large page, it will\nconditionally set the storage key in absolute memory using\nlarge_crste_to_phys() to get the absolute address.\n\nThere is a race window between dat_entry_walk() and\nlarge_crste_to_phys(): the large page could have been split\nconcurrently, and large_crste_to_phys() might be called with a crste\nthat does not designate a large page, leading to crashes.\n\nSimilar issues were also present in dat_set_storage_key().\n\ndat_get_storage_key() and dat_reset_reference_bit() did instead check\nfor a potential concurrent splitting of the large page, but then\nhandled it incorrectly.\n\nFix by performing a READ_ONCE on the crste pointer, checking and using\nthe result, instead of dereferencing the pointer again. In case a race\nis detacted, try dat_entry_walk() again.\n\n## Affected\n\n- `Linux >= 8e03e8316eb242af307d1c789d09f1a1457cf9a3 < c958f0498891203fddf2764b28f8b102c6bfd719`\n- `Linux >= 8e03e8316eb242af307d1c789d09f1a1457cf9a3 < 27554b9505ddfc0aeab466aeb60929dfa17284c7`\n- `Linux 7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}