CVE-2022-48798

What it actually does

Missing driver pointer validation before invoking path_event allows an FCES path-event on an unattached or incompatible device to dereference NULL and trigger a kernel panic on s390.

Why it matters to the business

Unprivileged local users or hardware-triggered events on affected kernels can crash the entire system, causing unplanned downtime and potential data loss on s390 Linux deployments.

How an attack unfolds

An attacker with local access or the ability to induce an FCES path-event on a device lacking a registered driver triggers the unchecked function pointer, resulting in an immediate kernel panic.

How to fix it

Upgrade the Linux kernel to commit fe990b7bf6ac93f1d850d076b8f0e758268aa4ab or later; apply the stable patch that adds the driver availability check before the path_event call.

How to confirm the fix worked

Confirm the running kernel contains commit fe990b7bf6ac93f1d850d076b8f0e758268aa4ab; attempt to attach devices without drivers and generate path-events in a test environment to verify absence of panic.

Typical attack path

1. Obtain local access or control hardware that can generate FCES path-events
2. Ensure the target device has no driver attached or the driver lacks a path_event handler
3. Trigger the path-event notification
4. Kernel dereferences invalid function pointer and panics

How to detect it

Review kernel logs for unexpected oops or panic entries referencing cio or path_event; examine audit logs for device attach/detach sequences immediately preceding crashes on s390 systems.

What your security team should do

• Prioritize kernel updates on all s390 systems within the next maintenance window
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict unprivileged local access on s390 hosts until patched