LiveActive security incident?Get immediate response
CVE Record

CVE-2024-56550: s390/stacktrace: Use break instead of return statement

In the Linux kernel, the following vulnerability has been resolved: s390/stacktrace: Use break instead of return statement arch_stack_walk_user_common() contains a return statement instead of a break statement in case store_ip() fails while trying to store a callchain entry of a user space process. This may lead to a missing pagefault_enable() call. If this happens any subsequent page fault of the process won't be resolved by the page fault handler and this in turn will lead to the process being killed. Use a break instead of a return statement to fix this.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-56550 is a Linux kernel reliability bug in s390 stack tracing. Under a specific failure path, the kernel may leave page-fault handling disabled for a process. A later page fault would not be resolved and the process can be killed, creating an availability risk.

Executive priority

Treat as a targeted availability and reliability issue. Immediate emergency action is not supported by the provided evidence, but s390/s390x production estates should include this in the next kernel maintenance cycle, faster where unexpected process death is business-critical.

Technical view

In arch_stack_walk_user_common(), store_ip() failure used return instead of break. That can skip pagefault_enable(), leaving page faults disabled for the process. The upstream fix changes control flow so cleanup runs before exit.

Likely exposure

Exposure appears limited to Linux systems using the s390 stacktrace code path, typically IBM Z/s390x environments. The source bundle lists Linux kernel versions including 6.10, 6.12.4, and 6.13 as affected, but distro-specific status is not provided.

Exploitation context

The provided sources do not report active exploitation, public exploit availability, or inclusion in CISA KEV. The described impact is process termination after a later page fault, not privilege escalation or data exposure.

Researcher notes

The key behavior is cleanup bypass: store_ip() failure returned from arch_stack_walk_user_common() before pagefault_enable(). The fix uses break, allowing expected cleanup. The source bundle lacks CVSS, CWE, exploitability analysis, and distro-level affected package mapping.

Mitigation direction

  • Check Linux distribution advisories for CVE-2024-56550 package status.
  • Upgrade to a kernel containing the referenced upstream stable fixes.
  • Prioritize s390/s390x production systems with critical workloads.
  • Validate observability or profiling workloads after kernel updates.
  • If no package exists, track vendor guidance for backports.

Validation and detection

  • Inventory Linux s390/s390x hosts and kernel versions.
  • Confirm vendor kernel packages include the referenced stable fixes.
  • Review process crash logs around stack tracing or profiling activity.
  • Test affected workloads after applying kernel updates.
  • Document any compensating controls until patched.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-56550 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxebd912ff9919a10609511383d94942362234c077, ebd912ff9919a10609511383d94942362234c077, dd69165ac3dc12d8550aeec3fc4439c084ded3d8, 6.9.4unaffected
LinuxLinux6.10, 0, 6.12.4, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.