In the Linux kernel, the s390/qeth driver allows privileged NET_ADMIN checks to be bypassed on certain SIOCDEVPRIVATE ioctl commands, specifically SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT. Because the driver fails to verify the CAP_NET_ADMIN capability, any local user who can open the qeth device node may execute these commands. This flaw permits an attacker to modify SNMP control settings, query card type information, or request on‑board accelerator data. The vulnerability is an improper authorization weakness, documented with CWE‑648 (Insufficient Access Control).

All Linux kernel builds that include the qeth driver for the s390 platform are affected. The vulnerability description does not specify a particular kernel version, so any system that ships with the qeth module and the exposed SIOCDEVPRIVATE ioctls on the s390 architecture is potentially vulnerable until a patch restoring the capability check is deployed.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a low probability of broad exploitation. Nevertheless, the flaw requires only local access to the qeth device file, meaning any untrusted local user or compromised process can leverage the unchecked ioctl calls to elevate privileges within the system. The risk is therefore significant for environments with weak local privilege separation.