CVE-2026-72025

A flaw was found in the Linux kernel's s390/monwriter component. This vulnerability allows a malicious local user with elevated privileges to cause memory corruption. By changing the data length during buffer reuse, the monwriter code fails to validate the new length, leading to an out-of-bounds write to the kernel buffer. While the monwriter device typically requires root permissions, successful exploitation could lead to system instability or further compromise.

A moderate out-of-bounds write flaw was found in the Linux kernel's s390 monwriter driver, which is specific to IBM Z (s390) systems. When monwriter reuses a data buffer, for example for interval sample records, the first record determines the data length and the size of the kernel buffer used for the user-space copy, and the code does not validate whether subsequent records change that data length. A malicious local user with access to the monwriter misc device could submit a later record with a larger data length, causing an out-of-bounds copy into the kernel buffer and kernel memory corruption, which can crash the system and cause a denial of service. Practical impact is typically low because the monwriter misc device is created with root-only permissions by default, so exploitation generally requires an already privileged local user; this is reflected in the Moderate rating with availability-only impact (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS kernel components the fix has been deferred to a future scheduled update because of the low practical exploitability; the residual risk until a fixed kernel is deployed is that a local user who already has access to the monwriter device could trigger kernel memory corruption, which in principle could also lead to further compromise of the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.