Loading vulnerability…
Linux kernel s390 SCLP SCCB NULL-check flaw
CVE-2025-39694 is an incorrect NULL-pointer check in the Linux kernel's s390 SCLP subsystem. Tracing code invoked by the SCLP interrupt handler checks whether the associated Service Call Control Block (SCCB) address is NULL only after physical-to-virtual address translation. When the kernel identity mapping starts at a nonzero address, translating a NULL physical address produces a non-NULL virtual address, bypassing the intended early exit. Subsequent processing can incorrectly access the first page of the identity mapping, potentially destabilizing the kernel.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Incorrect kernel memory accesses can cause kernel instability or denial of service on affected s390 systems. SUSE rates the vulnerability as having high availability impact with local, low-privileged exploitation prerequisites. Confidentiality and integrity impacts, arbitrary code execution, and privilege escalation are not established.
If you can’t patch tonight, do this now.
No confirmed vulnerability-specific workaround is available. Restricting untrusted local access can reduce exposure to the documented local attack vector but does not correct the faulty address handling. Prioritize deployment of a fixed kernel.
Patch, then assume compromise.
Install a vendor-supported kernel update incorporating the upstream fix titled "s390/sclp: Fix SCCB present check" and reboot into the updated kernel. The fix handles NULL SCCB addresses before physical-to-virtual address translation. Red Hat provides fixes through RHSA-2025:16398 for RHEL 9 and RHSA-2025:16904 for RHEL 10. For SUSE deployments, install the fixed kernel package specified for the exact product and service pack; do not assume that an initial livepatch package without actual fixes remediates the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.