CVE-2026-80549 (GCVE-0-2026-80549)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 12:40
VLAI
Title
s390/vfio_ccw: Move cp cleanup out of not operational
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the cio subchannel lock). Push the cleanup of the private->cp resources to a workqueue, where it can be done out from under that lock sequence and a future patch can safely manage the locking requirements.
Severity
8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 204b394a23ad5e30944f23518e21e844614da2ff , < c9b85aa2cf73ea645e55e2c2670e0ddebfe1589b (git)
Affected: 204b394a23ad5e30944f23518e21e844614da2ff , < f98a9890ca42f4223d2d4c50e0660af3e012fcb4 (git)
Affected: 204b394a23ad5e30944f23518e21e844614da2ff , < 4e3301e2a651d742c05914f6074a25b8e41bce19 (git)
Affected: 204b394a23ad5e30944f23518e21e844614da2ff , < af1759d8e6e6da9ba94f30a2f92546f406899aa7 (git)
Affected: 204b394a23ad5e30944f23518e21e844614da2ff , < 56100baa0eb7055b1026dfa73e696e8066ff71fd (git)
Affected: 204b394a23ad5e30944f23518e21e844614da2ff , < 0c11f61a876ed6fcca53d442ed3f33ea8362a0f9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_drv.c",
            "drivers/s390/cio/vfio_ccw_fsm.c",
            "drivers/s390/cio/vfio_ccw_ops.c",
            "drivers/s390/cio/vfio_ccw_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c9b85aa2cf73ea645e55e2c2670e0ddebfe1589b",
              "status": "affected",
              "version": "204b394a23ad5e30944f23518e21e844614da2ff",
              "versionType": "git"
            },
            {
              "lessThan": "f98a9890ca42f4223d2d4c50e0660af3e012fcb4",
              "status": "affected",
              "version": "204b394a23ad5e30944f23518e21e844614da2ff",
              "versionType": "git"
            },
            {
              "lessThan": "4e3301e2a651d742c05914f6074a25b8e41bce19",
              "status": "affected",
              "version": "204b394a23ad5e30944f23518e21e844614da2ff",
              "versionType": "git"
            },
            {
              "lessThan": "af1759d8e6e6da9ba94f30a2f92546f406899aa7",
              "status": "affected",
              "version": "204b394a23ad5e30944f23518e21e844614da2ff",
              "versionType": "git"
            },
            {
              "lessThan": "56100baa0eb7055b1026dfa73e696e8066ff71fd",
              "status": "affected",
              "version": "204b394a23ad5e30944f23518e21e844614da2ff",
              "versionType": "git"
            },
            {
              "lessThan": "0c11f61a876ed6fcca53d442ed3f33ea8362a0f9",
              "status": "affected",
              "version": "204b394a23ad5e30944f23518e21e844614da2ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_drv.c",
            "drivers/s390/cio/vfio_ccw_fsm.c",
            "drivers/s390/cio/vfio_ccw_ops.c",
            "drivers/s390/cio/vfio_ccw_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Move cp cleanup out of not operational\n\nThe fsm_notoper() routine is called when the device has been\nlost, and is (by definition) no longer operational. Since this\ncan happen asynchronously from the normal behavior of the\ndriver, the cleanup may happen when holding other locks\nin the calling sequence (notably, the cio subchannel lock).\n\nPush the cleanup of the private-\u003ecp resources to a workqueue,\nwhere it can be done out from under that lock sequence and\na future patch can safely manage the locking requirements."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local VFIO/mdev device access (pread/pwrite/ioctl on an opened vfio-ccw mediated device); the vulnerable cp_free() runs from FSM not-operational handling triggered by CIO subchannel events and VFIO I/O, not from any network protocol.\nAC:L - A VFIO client can submit channel programs and concurrently provoke not-operational transitions (device close/reset, in-flight I/O, or subchannel state changes), controlling both sides of the race without rare external timing.\nPR:H - Exploitation requires opening and operating an s390 vfio-ccw passthrough mdev, which needs host administrator setup and CAP_SYS_ADMIN-level VFIO/IOMMU access that cannot be obtained from an unprivileged user namespace.\nUI:N - No victim interaction is required beyond the attacker already having VFIO device access; triggering the bug is fully automated through concurrent I/O submissions and device state transitions.\nS:C - vfio-ccw manages guest DMA page pinning/unpinning through the IOMMU for channel I/O passthrough; unsynchronized cp_free() under the wrong locks can corrupt that isolation boundary between the VFIO guest and the host kernel.\nC:H - Concurrent unsynchronized cp_free() on an active channel_program can double-free or use-after-free kmalloc\u0027d ccwchain/page_array metadata and pinned page state, yielding kernel memory disclosure primitives per UAF guidance.\nI:H - The same race while unpining guest pages and freeing channel-program structures can corrupt heap metadata and IOMMU mappings, enabling arbitrary kernel write or control-flow hijack per memory-corruption guidance.\nA:H - Calling sleeping vfio_unpin_pages()/cp_free() while holding the subchannel spinlock can deadlock the kernel, and the concurrent double-free/UAF reliably causes kernel oops/panic under load."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:09.822Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c9b85aa2cf73ea645e55e2c2670e0ddebfe1589b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f98a9890ca42f4223d2d4c50e0660af3e012fcb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e3301e2a651d742c05914f6074a25b8e41bce19"
        },
        {
          "url": "https://git.kernel.org/stable/c/af1759d8e6e6da9ba94f30a2f92546f406899aa7"
        },
        {
          "url": "https://git.kernel.org/stable/c/56100baa0eb7055b1026dfa73e696e8066ff71fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c11f61a876ed6fcca53d442ed3f33ea8362a0f9"
        }
      ],
      "title": "s390/vfio_ccw: Move cp cleanup out of not operational",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80549",
    "datePublished": "2026-08-26T14:37:19.353Z",
    "dateReserved": "2026-08-26T14:34:25.766Z",
    "dateUpdated": "2026-08-27T12:40:09.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80549",
      "date": "2026-09-01",
      "epss": "0.00134",
      "percentile": "0.03233"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80549\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:09.323\",\"lastModified\":\"2026-08-27T13:18:39.583\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/vfio_ccw: Move cp cleanup out of not operational\\n\\nThe fsm_notoper() routine is called when the device has been\\nlost, and is (by definition) no longer operational. Since this\\ncan happen asynchronously from the normal behavior of the\\ndriver, the cleanup may happen when holding other locks\\nin the calling sequence (notably, the cio subchannel lock).\\n\\nPush the cleanup of the private-\u003ecp resources to a workqueue,\\nwhere it can be done out from under that lock sequence and\\na future patch can safely manage the locking requirements.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/s390/cio/vfio_ccw_drv.c\",\"drivers/s390/cio/vfio_ccw_fsm.c\",\"drivers/s390/cio/vfio_ccw_ops.c\",\"drivers/s390/cio/vfio_ccw_private.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"204b394a23ad5e30944f23518e21e844614da2ff\",\"lessThan\":\"c9b85aa2cf73ea645e55e2c2670e0ddebfe1589b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204b394a23ad5e30944f23518e21e844614da2ff\",\"lessThan\":\"f98a9890ca42f4223d2d4c50e0660af3e012fcb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204b394a23ad5e30944f23518e21e844614da2ff\",\"lessThan\":\"4e3301e2a651d742c05914f6074a25b8e41bce19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204b394a23ad5e30944f23518e21e844614da2ff\",\"lessThan\":\"af1759d8e6e6da9ba94f30a2f92546f406899aa7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204b394a23ad5e30944f23518e21e844614da2ff\",\"lessThan\":\"56100baa0eb7055b1026dfa73e696e8066ff71fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204b394a23ad5e30944f23518e21e844614da2ff\",\"lessThan\":\"0c11f61a876ed6fcca53d442ed3f33ea8362a0f9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/s390/cio/vfio_ccw_drv.c\",\"drivers/s390/cio/vfio_ccw_fsm.c\",\"drivers/s390/cio/vfio_ccw_ops.c\",\"drivers/s390/cio/vfio_ccw_private.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.185\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.5,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c11f61a876ed6fcca53d442ed3f33ea8362a0f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4e3301e2a651d742c05914f6074a25b8e41bce19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/56100baa0eb7055b1026dfa73e696e8066ff71fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af1759d8e6e6da9ba94f30a2f92546f406899aa7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c9b85aa2cf73ea645e55e2c2670e0ddebfe1589b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f98a9890ca42f4223d2d4c50e0660af3e012fcb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-27T14:55:50+00:00",
      "cve": "CVE-2026-80549",
      "id": "CVE-2026-80549",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: s390/vfio_ccw: Move cp cleanup out of not operational",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80549.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.