CVE-2025-39726

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/ism: fix concurrency management in ism_cmd()

The s390x ISM device data sheet clearly states that only one

request-response sequence is allowable per ISM function at any point in

time. Unfortunately as of today the s390/ism driver in Linux does not

honor that requirement. This patch aims to rectify that.

This problem was discovered based on Aliaksei's bug report which states

that for certain workloads the ISM functions end up entering error state

(with PEC 2 as seen from the logs) after a while and as a consequence

connections handled by the respective function break, and for future

connection requests the ISM device is not considered -- given it is in a

dysfunctional state. During further debugging PEC 3A was observed as

well.

A kernel message like

[ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a

is a reliable indicator of the stated function entering error state

with PEC 2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References