← Back to CVE Explorer

CVE-2025-39726

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: s390/ism: fix concurrency management in ism_cmd() The s390x ISM device data sheet clearly states that only one request-response sequence is allowable per ISM function at any point in time. Unfortunately as of today the s390/ism driver in Linux does not honor that requirement. This patch aims to rectify that. This problem was discovered based on Aliaksei's bug report which states that for certain workloads the ISM functions end up entering error state (with PEC 2 as seen from the logs) after a while and as a consequence connections handled by the respective function break, and for future connection requests the ISM device is not considered -- given it is in a dysfunctional state. During further debugging PEC 3A was observed as well. A kernel message like [ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a is a reliable indicator of the stated function entering error state with PEC 2. Let me also point out that a kernel message like [ 1211.244325] zpci: 061a:00:00.0: The ism driver bound to the device does not support error recovery is a reliable indicator that the ISM function won't be auto-recovered because the ISM driver currently lacks support for it. On a technical level, without this synchronization, commands (inputs to the FW) may be partially or fully overwritten (corrupted) by another CPU trying to issue commands on the same function. There is hard evidence that this can lead to DMB token values being used as DMB IOVAs, leading to PEC 2 PCI events indicating invalid DMA. But this is only one of the failure modes imaginable. In theory even completely losing one command and executing another one twice and then trying to interpret the outputs as if the command we intended to execute was actually executed and not the other one is also possible. Frankly, I don't feel confident about providing an exhaustive list of possible consequences.

Severity
MEDIUM
CVSS score
4.7 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-05 18:15:50.447000
Last modified
2026-10-30 13:18:08.900000
View original CVE JSON 
{
  "id": "CVE-2025-39726",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-09-05T18:15:50.447",
  "lastModified": "2026-10-30T13:18:08.900",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ism: fix concurrency management in ism_cmd()\n\nThe s390x ISM device data sheet clearly states that only one\nrequest-response sequence is allowable per ISM function at any point in\ntime.  Unfortunately as of today the s390/ism driver in Linux does not\nhonor that requirement. This patch aims to rectify that.\n\nThis problem was discovered based on Aliaksei's bug report which states\nthat for certain workloads the ISM functions end up entering error state\n(with PEC 2 as seen from the logs) after a while and as a consequence\nconnections handled by the respective function break, and for future\nconnection requests the ISM device is not considered -- given it is in a\ndysfunctional state. During further debugging PEC 3A was observed as\nwell.\n\nA kernel message like\n[ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a\nis a reliable indicator of the stated function entering error state\nwith PEC 2. Let me also point out that a kernel message like\n[ 1211.244325] zpci: 061a:00:00.0: The ism driver bound to the device does not support error recovery\nis a reliable indicator that the ISM function won't be auto-recovered\nbecause the ISM driver currently lacks support for it.\n\nOn a technical level, without this synchronization, commands (inputs to\nthe FW) may be partially or fully overwritten (corrupted) by another CPU\ntrying to issue commands on the same function. There is hard evidence that\nthis can lead to DMB token values being used as DMB IOVAs, leading to\nPEC 2 PCI events indicating invalid DMA. But this is only one of the\nfailure modes imaginable. In theory even completely losing one command\nand executing another one twice and then trying to interpret the outputs\nas if the command we intended to execute was actually executed and not\nthe other one is also possible.  Frankly, I don't feel confident about\nproviding an exhaustive list of possible consequences."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ns390/ism: corregir la gestión de concurrencia en ism_cmd()\n\nLa hoja de datos del dispositivo ISM s390x establece claramente que solo una secuencia de solicitud-respuesta es permitida por función ISM en cualquier momento. Desafortunadamente, a día de hoy, el controlador s390/ism en Linux no cumple con ese requisito. Este parche tiene como objetivo rectificar eso.\n\nEste problema fue descubierto basándose en el informe de error de Aliaksei, el cual establece que para ciertas cargas de trabajo las funciones ISM terminan entrando en estado de error (con PEC 2 como se ve en los registros) después de un tiempo y, como consecuencia, las conexiones manejadas por la función respectiva se rompen, y para futuras solicitudes de conexión el dispositivo ISM no es considerado -- dado que está en un estado disfuncional. Durante la depuración adicional también se observó PEC 3A.\n\nUn mensaje del kernel como\n[ 1211.244319] zpci: 061a:00:00.0: El evento 0x2 informa un error para la función PCI 0x61a\nes un indicador fiable de que la función mencionada entra en estado de error con PEC 2. Permítanme también señalar que un mensaje del kernel como\n[ 1211.244325] zpci: 061a:00:00.0: El controlador ism vinculado al dispositivo no soporta la recuperación de errores\nes un indicador fiable de que la función ISM no se recuperará automáticamente porque el controlador ISM actualmente carece de soporte para ello.\n\nA nivel técnico, sin esta sincronización, los comandos (entradas al FW) pueden ser parcial o totalmente sobrescritos (corrompidos) por otra CPU intentando emitir comandos en la misma función. Existe evidencia sólida de que esto puede llevar a que los valores de token DMB se utilicen como IOVA DMB, lo que lleva a eventos PCI PEC 2 que indican DMA inválido. Pero este es solo uno de los modos de fallo imaginables. En teoría, incluso perder completamente un comando y ejecutar otro dos veces y luego intentar interpretar las salidas como si el comando que pretendíamos ejecutar se hubiera ejecutado realmente y no el otro, también es posible. Francamente, no me siento seguro de proporcionar una lista exhaustiva de posibles consecuencias."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/s390/net/ism_drv.c",
            "include/linux/ism.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
              "lessThan": "79536c83cf38c285709757c4026da4ae151223ae",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
              "lessThan": "faf44487dfc80817f178dc8de7a0b73f960d019b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
              "lessThan": "1194ad0d44d66b273a02a3a22882dc863a68d764",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
              "lessThan": "fafaa4982bedb5532f5952000f714a3e63023f40",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
              "lessThan": "897e8601b9cff1d054cdd53047f568b0e1995726",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/s390/net/ism_drv.c",
            "include/linux/ism.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.19",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.19",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.101",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.41",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.15.9",
              "lessThanOrEqual": "6.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-15T21:53:46.367254Z",
          "id": "CVE-2025-39726",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.19",
              "versionEndExcluding": "6.6.101",
              "matchCriteriaId": "1D0E2D11-F76F-4AFC-90FA-DC5807724909"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.41",
              "matchCriteriaId": "7B9B92B6-A7E5-4697-AB94-8432ED55AA05"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.15.9",
              "matchCriteriaId": "656D6B8C-4D7B-4385-98B6-44EA4AFADD2E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "7A9C2DE5-43B8-4D73-BDB5-EA55C7671A52"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1194ad0d44d66b273a02a3a22882dc863a68d764",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/79536c83cf38c285709757c4026da4ae151223ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/897e8601b9cff1d054cdd53047f568b0e1995726",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/faf44487dfc80817f178dc8de7a0b73f960d019b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/fafaa4982bedb5532f5952000f714a3e63023f40",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}