Out-of-bounds read in Linux kernel - CVE-2026-99124

Vulnerability details

The vulnerability allows a local privileged user to cause an out-of-bounds read of kernel memory and include the data in a malformed SCLP error report.

The vulnerability exists due to an out-of-bounds read in the Linux kernel s390 PCI report_error_write() function when processing a buffer shorter than the report's declared payload length. A local privileged user can submit a buffer whose report->length exceeds the supplied payload size to copy up to approximately 4 KB of kernel data beyond the allocated buffer into the SCLP report. The privileged entity processing the report already has access to the relevant memory, so this does not expose data that entity could not otherwise access.

Affected software

How to mitigate CVE-2026-99124

External References

• https://git.kernel.org/stable/c/126a7c227d8543e13903dd5622640c1f0fcc5a16
• https://git.kernel.org/stable/c/8ac60ae2a307a50b599bf5d300b448d638f3ba29
• https://git.kernel.org/stable/c/ba5001db9bb23ff7d2ea328c405c287ffb07786f

Related Security Bulletins

• Out-of-bounds read in Linux kernel s390 pci
• Debian update for linux