Bug 2554893 (CVE-2026-98475)

Summary:	CVE-2026-98475 kernel: s390/cmf: Fix virtual vs physical address confusion
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresses. When extended format channel measurement data is recorded on systems using randomized memory configurations, the kernel fails to properly translate the target memory address before providing it to the system firmware. Consequently, the firmware writes measurement data into unintended physical memory locations, which can destabilize the system or result in a crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-18 15:26:07 UTC

In the Linux kernel, the following vulnerability has been resolved:

s390/cmf: Fix virtual vs physical address confusion

The measurement block address is an absolute address. Define the
associated schib_config and schib fields as dma64_t to enable automatic
detection of incorrect assignments. Also add the missing virt_to_dma64()
translation.

Without this fix, a wrong address will be used by firmware when storing
extended format channel measurement data on kernels built with
CONFIG_RANDOMIZE_IDENTITY_BASE=y.