CVE-2026-74467

A flaw was found in the s390/qeth component of the Linux kernel. An unprivileged local user could exploit this vulnerability by invoking specific SIOCDEVPRIVATE ioctl commands, such as SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT. These commands were not properly restricted by the CAP_NET_ADMIN capability check, allowing unauthorized access to network administration functions. This could lead to a privilege escalation, enabling the unprivileged user to perform actions reserved for privileged accounts.

A flaw in the Linux kernel s390/qeth network driver, rated by Red Hat as Moderate impact, affects Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2. The SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT were missing a CAP_NET_ADMIN capability check, so an unprivileged local user with access to a qeth network device could invoke adapter control operations that are intended to be restricted to network administrators, such as setting SNMP control parameters or querying adapter data. This is an access-control bypass in the qeth device control path rather than a memory corruption flaw, and it cannot be triggered by remote network traffic alone. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. Red Hat's severity (Moderate, CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVE rating (7.8, C:H/I:H/A:H) because Red Hat assesses the impact as limited to the availability of qeth adapter operations on the s390 architecture rather than a full compromise of confidentiality, integrity, and availability. The fix for the affected streams is currently deferred; the residual risk is that, until a fix is applied, a local unprivileged user on an affected system can continue to invoke these privileged ioctl operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.