SB20261029186 - Out-of-bounds read in Linux kernel s390 pci

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-99124)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds read of kernel memory and include the data in a malformed SCLP error report.

The vulnerability exists due to an out-of-bounds read in the Linux kernel s390 PCI report_error_write() function when processing a buffer shorter than the report's declared payload length. A local privileged user can submit a buffer whose report->length exceeds the supplied payload size to copy up to approximately 4 KB of kernel data beyond the allocated buffer into the SCLP report. The privileged entity processing the report already has access to the relevant memory, so this does not expose data that entity could not otherwise access.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/126a7c227d8543e13903dd5622640c1f0fcc5a16
• https://git.kernel.org/stable/c/8ac60ae2a307a50b599bf5d300b448d638f3ba29
• https://git.kernel.org/stable/c/ba5001db9bb23ff7d2ea328c405c287ffb07786f