EUVD-2026-76362
GHSA-54rx-hjqg-c852
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local s390-only path (AV:L), three simultaneous trigger conditions required (AC:H), process-level I/O privilege (PR:L); integrity is high (silent corruption) but confidentiality and availability impacts are low or absent.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Propagate partial completion length across ERP recovery
dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read.
Carry proc_bytes over to the original request like the other per-request state.
AnalysisAI
Silent data corruption in the Linux kernel's s390/dasd subsystem causes local processes to silently receive zeroed data for the unread portion of partially-completed ESE (Extent Space Efficient) disk reads that pass through the ERP (Error Recovery Procedure) chain. The root cause is dasd_default_erp_postaction() omitting the proc_bytes field when copying per-request state back from the ERP request to the originating request, which causes __dasd_cleanup_cqr() to treat the request as fully satisfied and return without requeuing the unread remainder. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must simultaneously hold: (1) the host must be an IBM Z (s390x) system with the Linux kernel's s390/dasd driver active; (2) the target storage volume must be configured as an ESE (Extent Space Efficient, thin-provisioned) DASD volume where some tracks are not yet physically allocated; (3) a read I/O request must span an unallocated track, causing a partial completion that triggers the kernel's ERP (Error Recovery Procedure) recovery chain. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is materially lower than the CVSS 7.0 base score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel: 6.12.109 or later for the 6.12 stable series, 6.18.50 or later for the 6.18 stable series, or 7.2.4 or later for the 7.2 stable series; the fix is also included in 7.3-rc1 and mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running on s390 architecture and document current kernel versions to identify affected platforms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today