Executive brief
A vulnerability was identified in the Linux kernel's hypervisor console support for S390 systems. An error in how the system counts supported devices could allow the software to attempt to access memory outside of its intended boundaries. This could potentially lead to a system crash or unpredictable behavior on affected mainframe environments.
Technical details
An off-by-one vulnerability exists in the hvc_iucv driver within the Linux kernel's TTY subsystem. The root cause is an incorrect boundary check in the hvc_iucv_get_private function, where the code used a 'greater than' comparison instead of 'greater than or equal to' when validating device indices against the hvc_iucv_devices counter. When the maximum number of lines (8) is configured, this flaw allows an out-of-bounds access to the hvc_iucv_table array at index 8. This can result in a kernel oops or memory corruption. The issue has been patched in various stable branches including 5.10.x, 5.15.x, 6.1.x, and later.
Affected products
- Linux Linux 2.6.29 to 6.13
Timeline
- 2026-01-29: other: Patch submitted by developer
- 2026-06-01: patched: Patch committed to stable tree
- 2026-06-26: disclosed: CVE published
References
- https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607
- https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babf
- https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff
- https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86
- https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064
- https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5
- https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241