# s390/pci: Fix leak of uninitialized kernel data in SCLP report

CVE record · `CVE-2026-99124`

- **Identifiers:** `CVE-2026-99124`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 28 Oct 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 28 Oct 2026, 10:34 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before ad1be38823d4b6dbc88648da296ca0c0f8824a55` (git)
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before 61ce6f9a527932f4482ebe00847490f17d63a0d1` (git)
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before 332f2d867f64dd530517e9a58394e3eab454df12` (git)
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before ff31c34e921d11c7da3d7664ce495106267ca408` (git)
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before eb10f25e32576bb3dbbea4457648614537f04211` (git)
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before ba5001db9bb23ff7d2ea328c405c287ffb07786f` (git)
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before 126a7c227d8543e13903dd5622640c1f0fcc5a16` (git)
  - affected: `368704a65be8620df795ccbeb44e025dafbc3e1f to before 8ac60ae2a307a50b599bf5d300b448d638f3ba29` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.7`
  - unaffected: `before 4.7` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.224 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.161 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.115 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.59 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.13 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0018, the 7th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 28 Oct 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-99124](https://www.cve.org/CVERecord?id=CVE-2026-99124)
- [NVD: CVE-2026-99124](https://nvd.nist.gov/vuln/detail/CVE-2026-99124)

### References from the CNA

- <https://git.kernel.org/stable/c/ad1be38823d4b6dbc88648da296ca0c0f8824a55>
- <https://git.kernel.org/stable/c/61ce6f9a527932f4482ebe00847490f17d63a0d1>
- <https://git.kernel.org/stable/c/332f2d867f64dd530517e9a58394e3eab454df12>
- <https://git.kernel.org/stable/c/ff31c34e921d11c7da3d7664ce495106267ca408>
- <https://git.kernel.org/stable/c/eb10f25e32576bb3dbbea4457648614537f04211>
- <https://git.kernel.org/stable/c/ba5001db9bb23ff7d2ea328c405c287ffb07786f>
- <https://git.kernel.org/stable/c/126a7c227d8543e13903dd5622640c1f0fcc5a16>
- <https://git.kernel.org/stable/c/8ac60ae2a307a50b599bf5d300b448d638f3ba29>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-99124>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-99124/>. Everything for agents: <https://agentprime.io/llms.txt>.