EUVD-2026-64377
GHSA-f2p8-hwvr-fwmq
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Race condition requires timing precision (AC:H); triggering device removal requires elevated local capability (PR:L); no network vector or scope change applies.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures.
No new interrupts will be generated after unregister_ieq(). Drain ongoing interrupt handlers by free_irq(), before freeing ism data structures.
AnalysisAI
Use-after-free in the Linux kernel's s390/ism driver allows a local attacker on IBM Z (s390) hardware to access freed kernel data structures during device teardown, potentially achieving privilege escalation or kernel memory corruption. The race condition arises because ISM interrupt handlers can remain active concurrently with ism_dev_exit(), reading the already-freed sba and ieq structures before free_irq() drains them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) IBM Z (s390x) hardware with an ISM-capable adapter physically present and the ism kernel module loaded; (2) the ability to initiate ISM device removal (ism_dev_exit()), which typically requires CAP_SYS_ADMIN or equivalent kernel capability - not accessible to unprivileged local users; (3) a concurrent active ISM interrupt handler executing at the precise moment of device teardown (a transient race window). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.4 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk on two metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with sufficient privilege to trigger ISM device removal initiates ism_dev_exit() while a concurrent ISM interrupt handler is executing. If the race window is won - the handler reads sba or ieq after they are freed - the attacker can influence freed kernel memory to achieve arbitrary kernel read/write, potentially escalating to root. … |
| Remediation | Upgrade to a patched stable kernel release: Linux 6.18.45, 7.1.9, or 7.2, per the upstream stable commits at https://git.kernel.org/stable/c/b1896543ce59c4258625a35cf41e23a9a1f80ea2 (6.18.x), https://git.kernel.org/stable/c/fc3021284050ecb3bba8a7851340cedcb5037928 (7.1.x), and https://git.kernel.org/stable/c/774394d27930ec4cf4cb3eed8ab6a4d20cb2430a (7.2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to identify all IBM Z systems running Linux kernels with the ism driver enabled and document their current patch levels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today