CVE-2025-37974

What it actually does

Missing validation of zpci_create_device() error pointer return allows dereference as a valid struct zpci_dev in __clp_add() during PCI scan list processing on s390.

Why it matters to the business

Kernel instability or crashes on IBM Z mainframe systems during PCI device handling can interrupt workloads and require reboots; low but non-zero risk of further exploitation given related kernel issues in the ecosystem.

How an attack unfolds

An attacker triggers the __clp_add() path (via PCI device discovery or CLP operations) to make zpci_create_device() return an error pointer; without the IS_ERR check the pointer is dereferenced, leading to a crash or potential memory corruption that could be chained with other kernel flaws for privilege escalation.

How to fix it

Upgrade Linux kernel to 6.12.29 or apply commit be54b750c333a9db7c3b3686846bb06b07b011fe; update neomutt on Ubuntu 20.04/22.04/24.04 Pro to the listed ESM fixed versions if those packages are present.

How to confirm the fix worked

Confirm kernel source contains the error check after zpci_create_device() call in __clp_add(); verify running kernel version is 6.12.29 or newer; test PCI scan paths do not panic on error returns.

Typical attack path

1. Gain local access or control hardware configuration on s390 system
2. Trigger PCI/CLP device scan that invokes __clp_add()
3. Force zpci_create_device() to return an error pointer
4. Dereference the unchecked error pointer causing invalid memory access

How to detect it

Search kernel logs and dmesg for s390 PCI oops/panics referencing __clp_add or zpci_create_device around device scan events; correlate with unusual CLP or PCI activity in audit logs.

• __clp_add
• zpci_create_device

What your security team should do

• Apply kernel updates immediately on all s390 systems
• Review and backport the fix to any custom or older stable kernels
• Monitor for related s390 PCI or kernel privilege-escalation activity
• Test PCI device hotplug and scan operations after patching