Description

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP_NET_ADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN capable check to ensure unprivileged users cannot invoke them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:51.403Z",
  "pubdate": "2026-08-15T13:17:51.403Z",
  "executiveSummary": "A privilege escalation and unauthorized access vulnerability exists within the Linux kernel s390 architecture qeth device driver, specifically concerning private ioctl command handling. The vulnerability arises because the driver historically failed to enforce sufficient capability checks when processing specific private ioctl commands, allowing unprivileged local users to invoke sensitive administrative operations. The affected components include the SIOCDEVPRIVATE ioctl commands, namely SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT. The impact of this security flaw includes unauthorized access to device configuration, status, and diagnostic data managed by the qeth network driver, potentially aiding further system compromise or information disclosure. Attack capabilities are limited to unprivileged local users who possess the ability to execute system calls and interact with network socket ioctls on the target system. Exploitation requires local system access and the ability to issue specifically crafted ioctl requests to network interfaces managed by the vulnerable s390 qeth driver. Risk implications involve potential bypass of access control boundaries on enterprise s390 mainframe systems, permitting unauthorized operational manipulation or telemetry gathering by unprivileged entities.",
  "technicalDetails": "The vulnerability resides in the s390 qeth network device driver of the Linux kernel, specifically within the handling of private ioctl interface requests channeled through SIOCDEVPRIVATE. The root cause of the issue is the absence of a proper permission gating mechanism, allowing any local user with access to create sockets to issue device-specific private ioctls without verifying whether the caller holds the appropriate administrative capabilities. Specifically, the commands SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT were exposed without requiring the CAP_NET_ADMIN capability. Exploitation occurs when an unprivileged local attacker crafts a malicious or unauthorized application that opens a socket and invokes the ioctl system call targeting a qeth interface using one of the aforementioned private ioctl command identifiers. Because the underlying driver functions executed the requested configuration or query logic unconditionally based solely on the receipt of the ioctl command, the kernel processed administrative requests originating from unprivileged contexts. The attack flow involves the local user initializing a socket file descriptor, populating the corresponding data structures expected by the qeth driver for commands such as SNMP control configuration, card type retrieval, or Open Systems Adapter (OSA) Express Address Table (OAT) queries, and subsequently executing the ioctl system call. The vulnerable component is the qeth driver implementation responsible for parsing and dispatching private ioctl requests. Privilege requirements prior to remediation were minimal, requiring only local interactive or programmatic access without privileged credentials. Network exposure is strictly local to the host operating system, as standard ioctl operations cannot be remotely invoked directly over network interfaces without an intermediary daemon or vulnerability in an exposed service. The post-exploitation impact includes unauthorized exposure of sensitive networking hardware topology, card configurations, and internal operational data, or unauthorized configuration of SNMP control parameters on enterprise IBM System z hardware."
}