CVE-2024-41068

What it actually does

Failure path in sclp_init() on s390 omits removal of sclp_state_change_event from sclp_reg_list, allowing duplicate list_add operations on subsequent failed calls and producing list corruption warnings in __list_add_valid_or_report.

Why it matters to the business

May cause boot-time warnings or kernel instability on IBM Z mainframes when sclp initialization repeatedly fails; low prevalence but affects core kernel startup reliability.

How an attack unfolds

An attacker with local access or the ability to induce repeated sclp_init failures (via crafted hardware state or early boot manipulation) can trigger the double-add path, surfacing the warning and potentially destabilizing the system; listed threat actors have targeted other Linux kernel issues but this specific flaw lacks public exploitation details.

How to fix it

Update to Linux kernel commit cf521049fcd07071ed42dc9758fce7d5ee120ec6 or later stable releases that include the fix; rebuild and deploy kernel images containing the corrected sclp_init cleanup logic.

How to confirm the fix worked

Confirm the fix by inspecting the sclp.c source for the added removal of sclp_state_change_event on error paths; boot test systems that deliberately fail sclp_init multiple times and verify absence of the list_add warning.

Typical attack path

1. Gain ability to influence early kernel initialization or hardware state on s390
2. Force multiple failing invocations of sclp_init()
3. Trigger duplicate registration of sclp_state_change_event
4. Observe list_add double-add warning and potential follow-on instability

How to detect it

Search kernel boot and dmesg logs for the string 'list_add double add' combined with references to sclp_init or __list_add_valid_or_report; review early initcall traces on s390 systems for repeated sclp failures.

• list_add double add: new=
• __list_add_valid_or_report
• sclp_init+0x40e/0x450

What your security team should do

• Prioritize patching s390 Linux kernels to the fixed commit within normal maintenance windows
• Include the change in all downstream distribution kernels and rebuild pipelines
• Monitor boot logs on s390 systems for the specific list_add warning until patched