In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: Fix kernel panic after setting hsuid
Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL.
Example: --------------------------------------------------------------------------- [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod qdio ccwgroup pkey zcrypt [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1 [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR) [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2) [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000 [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80 [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8 [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68 [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal >0000000000000002: 0000 illegal 0000000000000004: 0000 illegal 0000000000000006: 0000 illegal 0000000000000008: 0000 illegal 000000000000000a: 0000 illegal 000000000000000c: 0000 illegal 000000000000000e: 0000 illegal [ 2057.572800] Call Trace: [ 2057.572801] ([<00000000ec639700>] 0xec639700) [ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398 [ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0 [ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58 [ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60) [ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98 [ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70 [ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv] [ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv] [ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv] [ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8 [ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348 [ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8 [ 2057.572843] Last Breaking-Event-Address: [ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8 [ 2057.572846] [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt -------------------------------------------------------------------------------------------
Analysis: There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open().
Since commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again.
Reproduction: chzdev -e $devno layer2=0 ip link set dev $network_interface up echo 0 > /sys/bus/ccw ---truncated---
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 30, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Feb 10, 2025 | May 30, 2024 |
| Suse | — | Upgrade cluster-md-kmp-defaultUpgrade dtb-freescaleUpgrade gfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-rt-extraUpgrade kernel-syms-azureUpgrade kselftests-kmp-azureUpgrade kernel-obs-qaUpgrade dlm-kmp-defaultUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade dtb-appleUpgrade kernel-kvmsmallUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-azureUpgrade dtb-amlogicUpgrade kernel-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade kernel-azure-vdsoUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-devel-azureUpgrade dtb-marvellUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-azure-develUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-macrosUpgrade kernel-docs-htmlUpgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade dtb-socionextUpgrade kernel-obs-buildUpgrade dlm-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-azureUpgrade kernel-default-baseUpgrade kernel-64kbUpgrade dtb-amdUpgrade dtb-armUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-debug-develUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade kernel-rt_debug-develUpgrade kernel-64kb-develUpgrade dtb-nvidiaUpgrade dtb-caviumUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade dtb-alteraUpgrade kernel-debugUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-sourceUpgrade dtb-renesasUpgrade gfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-develUpgrade dtb-qcomUpgrade dtb-lgUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade dtb-xilinxUpgrade kernel-source-vanillaUpgrade kernel-source-azureUpgrade kernel-develUpgrade kernel-default-vdsoUpgrade dtb-sprdUpgrade dtb-exynos | Jun 13, 2024 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1064-kvmUpgrade linux-image-awsUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1070-azureUpgrade linux-image-azure-cvmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-oracleUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1050-gkeopUpgrade linux-image-azureUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-40-genericUpgrade linux-image-5.15.0-118-genericUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-5.15.0-1067-awsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1062-nvidiaUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1062-intel-iotgUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-5.15.0-118-generic-lpaeUpgrade linux-image-raspiUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1060-raspiUpgrade linux-image-oem-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-intelUpgrade linux-image-gkeUpgrade linux-image-oem-24.04aUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1062-nvidia-lowlatencyUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-genericUpgrade linux-image-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-118-lowlatency-64kUpgrade linux-image-oem-20.04bUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-118-lowlatencyUpgrade linux-image-5.15.0-1060-ibmUpgrade linux-image-5.15.0-1064-gkeUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64kUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-5.15.0-1065-oracleUpgrade linux-image-virtualUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1070-azure-fdeUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-oemUpgrade linux-image-5.15.0-118-generic-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1066-gcp | Aug 9, 2024 | May 30, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 30, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub