CVE-2026-98403

In the Linux kernel, the following vulnerability has been resolved:

s390/boot: Avoid IPL parameter append past command line

A command line may occupy all but the terminating byte of COMMAND LINE SIZE. In that case append ipl block parm() passes a zero size to the IPL parameter conversion helpers and points the destination one byte past early command line. The helpers subtract one from the unsigned size and write the converted parameter outside the command line buffer.

Convert the IPL parameter in the command line parsing buffer first. A parameter beginning with '=' can then replace the existing command line regardless of its length, while other parameters are appended only when space remains.