CVE-2024-42099

What it actually does

Invalid dereference of physical IDAL pointer instead of translated virtual address in dasd_eckd_dump_sense() and dasd_page_cache paths when indirect addressing (IDAW) is active, resulting in kernel panic on s390 systems.

Why it matters to the business

Unexpected crashes on IBM Z mainframes using DASD storage can cause unplanned downtime and service interruption; urgency is low given absence from KEV and flat low EPSS.

How an attack unfolds

An attacker with local access triggers an error path in DASD CCW handling that uses indirect addressing; the un-translated physical pointer is dereferenced, crashing the kernel before any data exfiltration or persistence occurs.

How to fix it

Upgrade Linux kernel to 6.9.9 or later, or apply commit c116475f7d6410b1e6d399207ac75de6cf9c3652 on affected stable trees; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm kernel version is 6.9.9 or newer; verify the fix commit appears in the running kernel source or package changelog; test DASD error injection to ensure no panic occurs.

Typical attack path

1. Obtain local execution context on s390 Linux system
2. Induce DASD error condition while IDAW indirect addressing is enabled
3. Force execution through dasd_eckd_dump_sense() or dasd_page_cache error path
4. Trigger kernel panic via invalid pointer dereference

How to detect it

Review kernel logs for oops or panic entries mentioning dasd_eckd_dump_sense or indirect CCW handling; correlate with DASD device error events around the crash timestamp.

What your security team should do

• Prioritize patching s390 systems that use DASD within standard change windows
• Monitor for kernel oops/panic logs referencing dasd_eckd_dump_sense
• Apply defense-in-depth by restricting local access on production mainframes