Answer in brief
CVE-2026-98403 records a Unknown severity vulnerability in s390/boot: Avoid IPL parameter append past command line. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5ecb2da660ab8eddafe059a6a8a708465db89ca2 <af9866021a00ab9eeacf0c33ee73f3d134b4ed70 || >=5ecb2da660ab8eddafe059a6a8a708465db89ca2 <73eec5a0d55916d7e1115f5d03a7ffc06d6215cf || >=5ecb2da660ab8eddafe059a6a8a708465db89ca2 <8d11bfec8666f8409fac9072e9c25b691d3e30ac || >=5ecb2da660ab8eddafe059a6a8a708465db89ca2 <d76181dfabdaa720703167393704efacba343442 | af9866021a00ab9eeacf0c33ee73f3d134b4ed70, 73eec5a0d55916d7e1115f5d03a7ffc06d6215cf, 8d11bfec8666f8409fac9072e9c25b691d3e30ac, d76181dfabdaa720703167393704efacba343442 |
| Linux/Linuxgeneric | 5.16 | Not reported |
Published upstream
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 14, 2026
In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to the IPL parameter conversion helpers and points the destination one byte past early_command_line. The helpers subtract one from the unsigned size and write the converted parameter outside the command line buffer. Convert the IPL parameter in the command line parsing buffer first. A parameter beginning with '=' can then replace the existing command line regardless of its length, while other parameters are appended only when space remains.
Quoted source text, attributed separately from HOL analysis.