CVE-2023-54117

What it actually does

Missing dax_remove_host() calls and flawed error handling in the dcssblk driver leave stale xarray entries; reuse of a prior gendisk pointer causes xa_insert failure, extra put_device, skipped device_del/klist_del, and list_add corruption crash on next device_add.

Why it matters to the business

Kernel panics on s390 systems performing repeated DCSS block device add/remove operations can cause unplanned downtime and require reboots; low prevalence and no known exploitation limit widespread operational risk.

How an attack unfolds

An attacker with local access triggers repeated dcssblk device registration and removal paths that exercise the missing dax_remove_host and broken out_dax error handling, eventually reusing a stale gendisk pointer and inducing list corruption on the subsequent add.

How to fix it

Upgrade the Linux kernel to a version containing commit 6489ec0107860345bc57dcde39e63dfb05ac5c11 or later; apply the same fix to any downstream stable trees or distributions shipping the dcssblk driver.

How to confirm the fix worked

Confirm the presence of commit 6489ec0107860345bc57dcde39e63dfb05ac5c11 in the running kernel source or package; exercise dcssblk device add/remove paths and verify no list_add corruption occurs.

Typical attack path

1. Obtain local shell or user context on an s390 Linux system
2. Trigger dcssblk device add/remove cycles (e.g., via module load/unload or hardware events)
3. Force error paths that omit dax_remove_host and perform extra put_device
4. Reuse previously freed gendisk pointer via blk_alloc_disk
5. Cause xa_insert failure followed by missing klist_del and list_add corruption crash

How to detect it

Search kernel logs for list_add corruption warnings, dax_add_host failures, or dcssblk device register/unregister error paths around the time of a crash.

What your security team should do

• Prioritize kernel updates on all s390 systems using dcssblk
• Monitor for kernel oops or list corruption panics referencing dax_add_host or dcssblk
• Restrict unprivileged access to DCSS block device operations until patched