In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: Fix kernel panic after setting hsuid
Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL.
Example: --------------------------------------------------------------------------- [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod qdio ccwgroup pkey zcrypt [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1 [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR) [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2) [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000 [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80 [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8 [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68 [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal >0000000000000002: 0000 illegal 0000000000000004: 0000 illegal 0000000000000006: 0000 illegal 0000000000000008: 0000 illegal 000000000000000a: 0000 illegal 000000000000000c: 0000 illegal 000000000000000e: 0000 illegal [ 2057.572800] Call Trace: [ 2057.572801] ([<00000000ec639700>] 0xec639700) [ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398 [ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0 [ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58 [ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60) [ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98 [ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70 [ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv] [ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv] [ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv] [ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8 [ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348 [ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8 [ 2057.572843] Last Breaking-Event-Address: [ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8 [ 2057.572846] [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt -------------------------------------------------------------------------------------------
Analysis: There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open().
Since commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again.
Reproduction: chzdev -e $devno layer2=0 ip link set dev $network_interface up echo 0 > /sys/bus/ccw ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 30, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Feb 10, 2025 | May 30, 2024 |
| Suse | — | Upgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kselftests-kmp-defaultUpgrade dtb-freescaleUpgrade ocfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-debug-livepatch-develUpgrade dtb-appleUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade dtb-socionextUpgrade kernel-default-livepatchUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade kernel-default-base-rebuildUpgrade kernel-macrosUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-extraUpgrade kernel-default-extraUpgrade gfs2-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade kernel-source-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-apmUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-kvmsmallUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade kernel-rtUpgrade kernel-rt_debugUpgrade dlm-kmp-azureUpgrade dtb-caviumUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade dtb-allwinnerUpgrade dtb-qcomUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-armUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-debug-develUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade kernel-rt-develUpgrade dtb-hisiliconUpgrade dtb-alteraUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade kernel-rt_debug-develUpgrade kernel-64kb-develUpgrade dtb-nvidiaUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-azureUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade dtb-exynosUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade kernel-source-vanillaUpgrade kernel-default-baseUpgrade kernel-sourceUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-default-optionalUpgrade dlm-kmp-64kbUpgrade dtb-renesas | Jun 13, 2024 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-gkeop-5.15Upgrade linux-image-raspiUpgrade linux-image-5.15.0-118-genericUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-generic-lpaeUpgrade linux-image-kvmUpgrade linux-image-5.15.0-1062-nvidiaUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-awsUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-5.15.0-1067-awsUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1064-kvmUpgrade linux-image-ibmUpgrade linux-image-azureUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1050-gkeopUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1062-intel-iotgUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1070-azureUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-azure-cvmUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-5.15.0-118-generic-lpaeUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-118-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-1066-gcpUpgrade linux-image-5.15.0-118-lowlatency-64kUpgrade linux-image-5.15.0-1060-ibmUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1064-gkeUpgrade linux-image-5.15.0-1065-oracleUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-1070-azure-fdeUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-oem-20.04dUpgrade linux-image-intelUpgrade linux-image-oem-24.04aUpgrade linux-image-gkeUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1062-nvidia-lowlatencyUpgrade linux-image-5.15.0-1060-raspiUpgrade linux-image-5.15.0-118-generic-64kUpgrade linux-image-oem-20.04bUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-oemUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-hwe-20.04 | Aug 9, 2024 | May 30, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub