CVE-2026-74467
Description
A flaw was found in the s390/qeth component of the Linux kernel. An unprivileged local user could exploit this vulnerability by invoking specific SIOCDEVPRIVATE ioctl commands, such as SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT. These commands were not properly restricted by the CAP_NET_ADMIN capability check, allowing unauthorized access to network administration functions. This could lead to a privilege escalation, enabling the unprivileged user to perform actions reserved for privileged accounts.
Statement
A flaw in the Linux kernel s390/qeth network driver, rated by Red Hat as Moderate impact, affects Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2. The SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT were missing a CAP_NET_ADMIN capability check, so an unprivileged local user with access to a qeth network device could invoke adapter control operations that are intended to be restricted to network administrators, such as setting SNMP control parameters or querying adapter data. This is an access-control bypass in the qeth device control path rather than a memory corruption flaw, and it cannot be triggered by remote network traffic alone. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. Red Hat's severity (Moderate, CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVE rating (7.8, C:H/I:H/A:H) because Red Hat assesses the impact as limited to the availability of qeth adapter operations on the s390 architecture rather than a full compromise of confidentiality, integrity, and availability. The fix for the affected streams is currently deferred; the residual risk is that, until a fix is applied, a local unprivileged user on an affected system can continue to invoke these privileged ioctl operations.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
An attacker may be able to elevate privileges.
Confidentiality
Technical Impact: Read Application Data
An attacker may be able to obtain sensitive information.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker may be able to execute code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
