Executive brief
The Linux kernel's s390/monwriter driver (a monitoring utility used on IBM s390 systems) failed to validate data length consistency when buffers are reused across multiple record writes. A privileged user could exploit this to trigger an out-of-bounds memory copy, potentially corrupting kernel memory. By default, only root can access the monwriter device, limiting practical exploitation.
Technical details
The vulnerability is an input validation flaw in drivers/s390/char/monwriter.c. When data buffers are reused for interval sample records, the first record establishes the buffer size and data length; however, the driver did not validate that subsequent records maintained the same data length. A malicious privileged user could change the data length on reused buffers, causing an out-of-bounds copy from user space to kernel buffer memory. The fix adds a check rejecting records that attempt to change the data length of an already-allocated buffer. The device is created with root-only permissions by default, significantly reducing practical attack surface.
Affected products
- Linux Linux kernel multiple versions across 2.6 through 7.2 series
Timeline
- 2026-08-15: disclosed
- 2026-06-23: patched: commit 01f3ce411711c2c919598ea25320a5a48f71edbc by Gerald Schaefer