CVE-2026-98475None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
s390/cmf: Fix virtual vs physical address confusion
The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also add the missing virt_to_dma64() translation.
Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y.
Linux >= 14edd0d73bfef320fd5be11495687ba537aa6341 < b11f369be31ea11c746833e4d3ad51dcd6b5fa2bLinux >= 14edd0d73bfef320fd5be11495687ba537aa6341 < 748ec2f7f5df9b4fc742546a8bfc8aa5d847353eLinux >= 14edd0d73bfef320fd5be11495687ba537aa6341 < 7f78226eb743b362f52b212d7763801642539d1cLinux >= 14edd0d73bfef320fd5be11495687ba537aa6341 < f4d04425e66af2ecee9d1a49ae0484436f3c2fd1Linux 6.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers
CVE-2026-98776Nonebinderfs: fix UAF write in binder_add_device