Linux Kernel qeth
CVE-2024-36928
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain privileged local access to s390 LPAR
-
DeliveryConfigure IQD Layer3 qeth device
-
ExploitBring network interface UP
-
InstallWrite hsuid sysfs attribute while interface is UP
-
C2qeth_free_qdio_queues clears napi.poll pointer
-
ExecuteNetwork softirq calls __napi_poll via NULL pointer
-
ImpactKernel panic crashes LPAR
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of the following: (1) IBM s390/zSeries mainframe hardware running Linux - this vulnerability does not exist on any other architecture; (2) the qeth_l3 kernel module loaded with at least one IQD (HiperSockets) Layer3 network device configured (Layer2 qeth devices are not affected by this specific code path); (3) the network interface corresponding to that IQD device must already be in the UP state at the time of the trigger; (4) local access with privileges sufficient to write to the qeth device sysfs attribute for hsuid (typically root on standard Linux configurations). Exploitation is limited to denial of service (kernel panic and LPAR crash); no path to code execution or data exfiltration is established. The CVSS PR:L assignment in the NVD entry may understate the privilege level - sysfs device attribute writes typically require root, which limits the realistic attacker population further. |
| Impact | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates the realistic impact. C:H and I:H reflect theoretical full kernel compromise from a kernel panic, but the actual exploitable outcome is a system crash (A:H); no code execution or data exfiltration path is established by this vulnerability. Independently assessed, PR should be H (writing sysfs device attributes requires root-level access on standard Linux configurations), which would reduce the score to approximately 4.4. EPSS at 0.22% (12th percentile) is consistent with the narrow attack surface: IBM s390 mainframe hardware only, IQD Layer3 configuration required, local privileged access needed, and a specific sequencing condition (hsuid write while interface UP). The vulnerability is not in CISA KEV and no POC has been identified, confirming it has not been weaponized. Priority is low for all but IBM mainframe operators running IQD Layer3 HiperSockets networks. |
| Exploit ScenarioDerived | An administrator or privileged local user on an IBM s390 LPAR with an IQD Layer3 HiperSockets network device runs 'ip link set dev eth0 up' and then writes a new value to the hsuid sysfs attribute while the interface remains UP. The qeth driver's offline/online cycle clears the napi.poll function pointer via qeth_free_qdio_queues() without restoring it, because dev_open() is no longer called. The next network packet triggers net_rx_action() in softirq context, which calls __napi_poll() through the NULL pointer, generating an s390 illegal operation exception at address 0x2 and crashing the entire LPAR with 'Kernel panic - not syncing: Fatal exception in interrupt'. No public exploit code exists for this scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 04, 2026
Kernel panic via NULL pointer dereference in the s390 qeth IQD Layer3 network driver affects IBM mainframe Linux systems running kernel versions up to 6.9-rc5. Setting the hsuid attribute on an IQD Layer3 device while its network interface is UP causes qeth_free_qdio_queues() to clear napi.poll function pointers that are never restored, because commit 1cfef80d4c2b removed the dev_close()/dev_open() calls that previously handled re-initialization. When subsequent network softirq processing invokes __napi_poll() against the NULL pointer, the s390 CPU triggers an illegal operation exception and fatal kernel panic. No public exploit code exists and EPSS at 0.22% (12th percentile) reflects the highly specific trigger conditions and niche hardware footprint; this vulnerability is not in CISA KEV.
Earlier versions of this analysis (1)
Kernel panic via NULL pointer dereference in the s390/qeth IQD Layer3 driver allows a local operator to crash an IBM z-Series system by setting the hsuid attribute while the associated HiperSockets network interface is UP. The defect was introduced when commit 1cfef80d4c2b removed the dev_close()/dev_open() cycle from the offline/online transition, leaving napi.poll function pointers zeroed and unrestored after qeth_free_qdio_queues() clears them. No public exploit exists and EPSS is 0.22% (12th percentile), but patches have been applied across five kernel stable branches, confirming the defect is reproducible and fix-worthy.
RemediationAI
Apply the upstream stable kernel patches confirmed by NVD references: https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6, https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524, https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494, https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3, and https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282. Exact fixed distribution kernel versions (RHEL, SUSE, Ubuntu mainframe) are not independently confirmed from available data - monitor vendor errata channels for s390x kernel updates. As an immediate operational workaround, always take the network interface DOWN (ip link set dev <if> down) before writing the hsuid attribute to any IQD Layer3 qeth device, then bring it UP again afterward; this ensures qeth_open() re-initializes the napi.poll pointers correctly. This workaround has no functional trade-offs for planned maintenance windows but does introduce a brief network interruption.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the qeth driver (qeth_l3 kernel module) for IBM s390/zSeries mainframes, which manages HiperSockets (IQD - Internal Queued Direct I/O) network adapters. Linux's NAPI (New API) subsystem uses per-queue poll function pointers stored in card->qdio.out_qs[i].napi.poll to batch network receive processing and reduce interrupt overhead. These pointers are initialized in qeth_open(). Since commit 1cfef80d4c2b ('s390/qeth: Don't call dev_close/dev_open (DOWN/UP)'), the qeth_set_offline()/qeth_set_online() path no longer calls dev_close()/dev_open(), so qeth_free_qdio_queues() can zero out the napi.poll pointer while the interface remains UP. CWE-476 (NULL Pointer Dereference) is the root cause: net_rx_action() invokes __napi_poll() which calls through the now-NULL function pointer, executing address 0x0 on s390 and producing an 'illegal operation' trap that escalates to kernel panic. CPE cpe:2.3:o:linux:linux_kernel covers all affected stable branches plus 6.9-rc1 through 6.9-rc5 as confirmed by NVD.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Writing sysfs device attributes requires root privileges (PR:H); realistic impact is kernel panic only (A:H), with no confidentiality or integrity compromise achievable.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: Fix kernel panic after setting hsuid
Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL.
Example: --------------------------------------------------------------------------- [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod qdio ccwgroup pkey zcrypt [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1 [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR) [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2) [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000 [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80 [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8 [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68 [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal >0000000000000002: 0000 illegal 0000000000000004: 0000 illegal 0000000000000006: 0000 illegal 0000000000000008: 0000 illegal 000000000000000a: 0000 illegal 000000000000000c: 0000 illegal 000000000000000e: 0000 illegal [ 2057.572800] Call Trace: [ 2057.572801] ([<00000000ec639700>] 0xec639700) [ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398 [ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0 [ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58 [ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60) [ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98 [ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70 [ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv] [ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv] [ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv] [ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8 [ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348 [ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8 [ 2057.572843] Last Breaking-Event-Address: [ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8 [ 2057.572846] [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt -------------------------------------------------------------------------------------------
Analysis: There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open().
Since commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again.
Reproduction: chzdev -e $devno layer2=0 ip link set dev $network_interface up echo 0 > /sys/bus/ccw ---truncated---
Executive ViewAI
A critical kernel defect in IBM mainframe Linux systems (s390 qeth network driver, kernels up to 6.9-rc5) causes complete system panic during routine network configuration changes. Organizations using mainframe Linux deployments face unplanned downtime for mission-critical workloads and should prioritize immediate patching, despite this vulnerability's niche hardware footprint.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB