CVE-2024-43865

What it actually does

Missing exception handling around the lfpc instruction in load_fpu_state() allows invalid floating-point register values to trigger an unhandled specification exception on s390.

Why it matters to the business

Systems running the affected Linux kernel on IBM Z hardware may experience unexpected kernel crashes or instability when floating-point state is loaded.

How an attack unfolds

An attacker with the ability to influence floating-point register contents (via local code execution or crafted workloads) can cause the kernel to load invalid FPU state; without the restored exception handler the resulting specification exception is not caught and the system crashes.

How to fix it

Update the Linux kernel on s390 systems to a version that includes commit 494b14138201f07343e5488db6360c828fcc8cf6 or later; apply the stable kernel update that restores exception handling in load_fpu_state().

How to confirm the fix worked

Verify the running kernel contains commit 494b14138201f07343e5488db6360c828fcc8cf6; confirm load_fpu_state() again contains the lfpc exception handler; test with workloads that previously produced invalid FPU state.

Typical attack path

1. Obtain local code execution or submit a workload on an s390 Linux system
2. Craft or trigger floating-point operations that produce invalid register values
3. Force the kernel to execute load_fpu_state() with the bad state
4. Trigger the unhandled specification exception and induce a kernel panic

How to detect it

Search kernel logs and crash dumps for unhandled specification exceptions originating from load_fpu_state() or the lfpc instruction; correlate with processes performing floating-point operations around the time of the crash.

• specification exception.*load_fpu_state
• lfpc.*exception

What your security team should do

• Patch s390 Linux kernels to the fixed commit as soon as possible
• Prioritize systems that perform floating-point heavy workloads
• Monitor kernel logs for specification exceptions during FPU state loads until patched