Executive brief
The Linux kernel's s390 DASD (Direct Access Storage Device) driver incorrectly marked failed thin-provisioned disk reads as successful, delivering uninitialized memory to applications instead of zeroed data. This could cause data corruption or information disclosure when reading from unallocated regions of thin-provisioned storage devices, potentially exposing sensitive information from freed memory or causing application failures.
Technical details
The vulnerability exists in the DASD interrupt handler (dasd_int_handler) for s390 architecture. When processing NRF (No Record Found) reads of unallocated ESE (Enterprise Storage Extension) tracks on thin-provisioned devices, the handler calls ese_read() to zero the destination buffer but unconditionally marks the request as DASD_CQR_SUCCESS regardless of the return value. The ese_read() function can fail early (e.g., during sense-data parsing or range validation) without zeroing the buffer. The fix checks the ese_read() return value and properly sets the request status to DASD_CQR_ERROR on failure instead of forcing success. This is a local attack vector affecting systems using s390 DASD thin-provisioned storage. Patches are available in the Linux stable tree.
Affected products
- Linux Linux kernel Multiple versions (all s390 DASD affected versions prior to patch)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Fix committed to stable tree