A high-severity memory management vulnerability in the Linux kernel s390 vfio_ccw driver allows local attackers with low privileges to trigger use-after-free conditions, potentially leading to system compromise.

The vulnerability exists in the s390 vfio_ccw driver, where io_work and crw_work workqueues are not properly uninitialized during the _release_dev process. This allows work to be dispatched after the associated private data structure has been freed, requiring an authenticated local user with low privileges to trigger.

The vulnerability carries a CVSS score of 8.8, indicating a high risk of exploitation. Successful exploitation allows a local user to achieve scope escalation and potentially execute arbitrary code with kernel-level privileges, resulting in complete system compromise, data theft, or persistent denial of service.

Immediate Action: Update the Linux kernel to version 6.6.153, 6.12.105, 6.18.46, 7.1.10, or later, depending on your distribution branch. Organizations should prioritize patching systems that utilize s390 virtualization features.

Proactive Monitoring: Monitor kernel logs for segmentation faults or unexpected system crashes related to the vfio_ccw driver. Review audit logs for suspicious activity originating from low-privileged local user accounts.

Compensating Controls: Restrict access to systems utilizing s390 virtualization to only essential personnel. Disable vfio_ccw modules if they are not required for current business operations to reduce the attack surface.

Public Exploit Available: No

Given the potential for privilege escalation and the high CVSS score, this vulnerability should be treated as a priority for all systems running affected Linux kernel versions. Administrators must apply the provided kernel patches as soon as they are available in their respective distribution repositories to mitigate the risk of local exploitation.