LiveActive security incident?Get immediate response
CVE Record

CVE-2024-27009: s390/cio: fix race condition during online processing

In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix race condition during online processing A race condition exists in ccw_device_set_online() that can cause the online process to fail, leaving the affected device in an inconsistent state. As a result, subsequent attempts to set that device online fail with return code ENODEV. The problem occurs when a path verification request arrives after a wait for final device state completed, but before the result state is evaluated. Fix this by ensuring that the CCW-device lock is held between determining final state and checking result state. Note that since: commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") path verification requests are much more likely to occur during boot, resulting in an increased chance of this race condition occurring.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-27009 is a Linux kernel race condition in s390 channel I/O device online processing. It can leave an affected device in an inconsistent state, causing later attempts to bring that device online to fail. The business impact is mainly availability and operational reliability for Linux systems using this subsystem.

Executive priority

Treat this as an availability risk for specialized Linux environments rather than a broad internet-facing emergency. If the organization runs s390 Linux infrastructure, prioritize routine kernel remediation and operational monitoring. If not, exposure is likely minimal based on the provided sources.

Technical view

The issue is in ccw_device_set_online(). A path verification request can arrive after waiting for final device state but before result evaluation. The fix holds the CCW-device lock between determining final state and checking result state. Sources do not provide CVSS, CWE, or exploit details.

Likely exposure

Exposure appears limited to Linux systems using the s390/cio CCW device path on affected kernel versions listed by the CVE source bundle, including 5.15, 5.15.157, 6.1.88, 6.6.29, 6.8.8, and 6.9. Confirm distribution backports before deciding exposure.

Exploitation context

The source bundle does not indicate active exploitation, and the CVE is not listed as KEV. The described failure is a race condition during device online processing, with increased likelihood during boot after commit 2297791c92d0. No offensive technique is documented in the provided sources.

Researcher notes

Evidence is sparse: no CVSS, CWE, proof of exploitation, or detailed distro impact matrix is included. The core signal is the upstream Linux fix and Fedora package announcements. Validation should focus on architecture, kernel lineage, backport status, and observed CCW device online failures.

Mitigation direction

  • Apply vendor or distribution kernel updates containing the referenced stable fixes.
  • Prioritize s390 Linux hosts where device online failures affect production availability.
  • Review Fedora kernel advisories if Fedora systems are in scope.
  • Check vendor guidance for exact fixed kernel builds and backports.
  • Plan reboots or maintenance windows according to normal kernel update procedures.

Validation and detection

  • Inventory Linux systems running on the s390 architecture or using s390/cio.
  • Compare running kernel versions against vendor fixed builds and advisories.
  • Review boot and device-online logs for repeated ENODEV failures.
  • Confirm the referenced stable fix is present in the deployed kernel source or changelog.
  • Track remediation status separately for distribution backports and upstream versions.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-27009 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2297791c92d04a154ad29ba5a073f9f627982110, 2297791c92d04a154ad29ba5a073f9f627982110, 2297791c92d04a154ad29ba5a073f9f627982110, 2297791c92d04a154ad29ba5a073f9f627982110, 2297791c92d04a154ad29ba5a073f9f627982110unaffected
LinuxLinux5.15, 0, 5.15.157, 6.1.88, 6.6.29, 6.8.8, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.