{"id":"CVE-2026-98475","title":"kernel: s390/cmf: Fix virtual vs physical address confusion (CVE-2026-98475)","summary":"A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresse…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","cvssSource":"vendor","cwe":"CWE-787","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-10-18","updated":"2026-10-20","sourceUpdated":"2026-10-20T11:13:56+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98475.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98475.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98475"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554893"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98475"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98475"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98475.mbox"},{"url":"https://git.kernel.org/stable/c/b11f369be31ea11c746833e4d3ad51dcd6b5fa2b"},{"url":"https://git.kernel.org/stable/c/748ec2f7f5df9b4fc742546a8bfc8aa5d847353e"},{"url":"https://git.kernel.org/stable/c/7f78226eb743b362f52b212d7763801642539d1c"},{"url":"https://git.kernel.org/stable/c/f4d04425e66af2ecee9d1a49ae0484436f3c2fd1"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00168,"epssPercentile":0.06026,"ingestedAt":"2026-10-18T15:45:12.296Z","slug":"CVE-2026-98475","body":"## Overview\n\nA flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresses. When extended format channel measurement data is recorded on systems using randomized memory configurations, the kernel fails to properly translate the target memory address before providing it to the system firmware. Consequently, the firmware writes measurement data into unintended physical memory locations, which can destabilize the system or result in a crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98475.json)\n\n**kernel: s390/cmf: Fix virtual vs physical address confusion** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225658,"id":"CVE-2026-98475","ts":1792498338785,"field":"cvss","old":null,"new":"5.1"},{"seq":225657,"id":"CVE-2026-98475","ts":1792498338785,"field":"severity","old":"none","new":"medium"}]}