In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Propagate partial completion length across ERP recovery

dasd default erp postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. dasd cleanup cqr() then sees proc bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read.

Carry proc bytes over to the original request like the other per-request state.