Not yet scoredPublished Oct 18, 2026

CVE-2026-98475s390/cmf: Fix virtual vs physical address confusion

Updated under an hour ago (Oct 26, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also add the missing virt_to_dma64() translation. Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 14edd0d73bfef320fd5be11495687ba537aa6341 before b11f369be31ea11c746833e4d3ad51dcd6b5fa2b; from 14edd0d73bfef320fd5be11495687ba537aa6341 before 748ec2f7f5df9b4fc742546a8bfc8aa5d847353e; 14edd0d73bfef320fd5be11495687ba537aa6341 builds before 7f78226eb743b362f52b212d7763801642539d1c; from 14edd0d73bfef320fd5be11495687ba537aa6341 before f4d04425e66af2ecee9d1a49ae0484436f3c2fd1	CNA record

References

References

https://git.kernel.org/stable/c/b11f369be31ea11c746833e4d3ad51dcd6b5fa2b
https://git.kernel.org/stable/c/748ec2f7f5df9b4fc742546a8bfc8aa5d847353e
https://git.kernel.org/stable/c/7f78226eb743b362f52b212d7763801642539d1c
https://git.kernel.org/stable/c/f4d04425e66af2ecee9d1a49ae0484436f3c2fd1

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.