CVE-2024-27054

What it actually does

Double module reference count decrement on error paths in the s390 DASD driver after discipline association, causing artificial refcount reduction instead of maintaining correct count until device deletion.

Why it matters to the business

On IBM Z mainframe systems using DASD storage, repeated error conditions during device handling can lead to incorrect module unloading, resulting in kernel instability, crashes, or denial of service affecting storage operations and workloads.

How an attack unfolds

An attacker with local access triggers specific error paths during DASD device discipline association and deletion sequences; the double decrement allows premature module reference drop, enabling potential use-after-free or module manipulation scenarios on affected kernels.

How to fix it

Update the Linux kernel to a version containing commit 9fe0562179d8fa960afca0eaed6d4ba4122a3cc6 or later; rebuild and deploy the fixed kernel across all affected s390 systems, then reboot to apply.

How to confirm the fix worked

Verify kernel source or binary contains the referenced commit hash; test device association and error paths in a lab environment to confirm refcount remains stable; monitor module refcount values during device lifecycle operations.

Typical attack path

1. Obtain local access on s390 Linux system with DASD devices
2. Trigger device creation and discipline association followed by error injection on deletion path
3. Exploit resulting refcount imbalance to influence module lifecycle or memory state

How to detect it

Review kernel logs for DASD discipline association errors and unexpected module unload messages; inspect refcount values via debugfs or crash dumps on s390 systems; correlate device deletion events with module state changes.

What your security team should do

• Prioritize kernel updates on all s390 systems using DASD within standard change windows
• Audit custom or out-of-tree DASD-related modules for similar refcount patterns
• Include kernel version checks in vulnerability scanning for mainframe fleets