CVE-2024-36928: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36928 affects the Linux kernel's s390/qeth subsystem. The vulnerability manifests when the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, causing the kernel to attempt executing a NULL napi function pointer. This issue was discovered in May 2024 and has been assigned a CVSS 3.1 base score of 4.4 (Medium) (CISA-ADP).

The vulnerability stems from a flaw in the qeth driver's handling of completion queues (CQ). When the hsuid attribute is modified, the driver previously freed output queues unnecessarily, which could lead to a NULL napi function pointer. The issue occurs because since commit 1cfef80d4c2b, qeth_set_offline()/qeth_set_online() no longer call dev_close()/dev_open(), resulting in napi.poll functions not being properly reset (Kernel Commit).

When exploited, this vulnerability results in a kernel panic, causing a system crash. This occurs specifically when attempting to execute a NULL napi function pointer, leading to a fatal exception in interrupt handling (Kernel Commit).

The vulnerability can be triggered by setting the hsuid attribute on an IQD Layer3 device after the network interface is already UP. The crash can be enforced through various actions such as af_iucv connect() or ip link down/up operations (Kernel Commit).

Two workarounds are available: 1) Set hsuid before setting the device online for the first time, or 2) Use the command sequence: 'chzdev -d $devno; chzdev $devno hsuid=xxx; chzdev -e $devno' to set hsuid on an existing device, which will remove and recreate the network interface. The permanent fix involves modifying the completion queue handling to prevent unnecessary freeing of output queues (Kernel Commit).