Vulnerability-Lookup

FKIE_CVE-2026-80554

Vulnerability from fkie_nvd - Published: 2026-08-26 15:17 - Updated: 2026-08-27 06:17

Severity

9.3 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/15fb4559a7fdf0b8725e433a71cfd03a1313a48b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4ee94790490ae8dcc97df8597f07836c8a81bbcf
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5405c90d6a47b3014e74ee0618a162449abbbc93
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a1625f66eaa1200068a0e2c05bc90e65182fc4e3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_cp.c",
            "drivers/s390/cio/vfio_ccw_cp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15fb4559a7fdf0b8725e433a71cfd03a1313a48b",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "a1625f66eaa1200068a0e2c05bc90e65182fc4e3",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "4ee94790490ae8dcc97df8597f07836c8a81bbcf",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "5405c90d6a47b3014e74ee0618a162449abbbc93",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_cp.c",
            "drivers/s390/cio/vfio_ccw_cp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Limit the number of channel program segments\n\nThe processing of channel programs, and the CCWs within them, is done\nrecursively. As such, there is an arbitrary (but not architectural)\nlimit to the number of CCWs that can exist in a single channel program.\n\nThe vfio-ccw logic breaks these channel programs into segments whenever\nit encounters a Transfer-In-Channel (TIC) CCW, and the combined number\nof segments count towards the global limit. Impose an equivalent limit\nto the number of segments until such logic can be made non-recursive."
    }
  ],
  "id": "CVE-2026-80554",
  "lastModified": "2026-08-27T06:17:38.923",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-26T15:17:09.990",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/15fb4559a7fdf0b8725e433a71cfd03a1313a48b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4ee94790490ae8dcc97df8597f07836c8a81bbcf"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5405c90d6a47b3014e74ee0618a162449abbbc93"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a1625f66eaa1200068a0e2c05bc90e65182fc4e3"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-80554 (GCVE-0-2026-80554)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01

Title

s390/vfio_ccw: Limit the number of channel program segments

Summary

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/15fb4559a7fdf0b87…
https://git.kernel.org/stable/c/a1625f66eaa120006…
https://git.kernel.org/stable/c/06f4d6e5a8af6c207…
https://git.kernel.org/stable/c/4ee94790490ae8dcc…
https://git.kernel.org/stable/c/5405c90d6a47b3014…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0a19e61e6d4c6192077ead760ba0a2d350987d4c , < 15fb4559a7fdf0b8725e433a71cfd03a1313a48b (git) Affected: 0a19e61e6d4c6192077ead760ba0a2d350987d4c , < a1625f66eaa1200068a0e2c05bc90e65182fc4e3 (git) Affected: 0a19e61e6d4c6192077ead760ba0a2d350987d4c , < 06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2 (git) Affected: 0a19e61e6d4c6192077ead760ba0a2d350987d4c , < 4ee94790490ae8dcc97df8597f07836c8a81bbcf (git) Affected: 0a19e61e6d4c6192077ead760ba0a2d350987d4c , < 5405c90d6a47b3014e74ee0618a162449abbbc93 (git)
Linux	Linux	Affected: 4.12 Unaffected: 0 , < 4.12 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_cp.c",
            "drivers/s390/cio/vfio_ccw_cp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15fb4559a7fdf0b8725e433a71cfd03a1313a48b",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "a1625f66eaa1200068a0e2c05bc90e65182fc4e3",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "4ee94790490ae8dcc97df8597f07836c8a81bbcf",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "5405c90d6a47b3014e74ee0618a162449abbbc93",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_cp.c",
            "drivers/s390/cio/vfio_ccw_cp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Limit the number of channel program segments\n\nThe processing of channel programs, and the CCWs within them, is done\nrecursively. As such, there is an arbitrary (but not architectural)\nlimit to the number of CCWs that can exist in a single channel program.\n\nThe vfio-ccw logic breaks these channel programs into segments whenever\nit encounters a Transfer-In-Channel (TIC) CCW, and the combined number\nof segments count towards the global limit. Impose an equivalent limit\nto the number of segments until such logic can be made non-recursive."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via local VFIO-ccw mediated-device write()/ioctl on the I/O region (QEMU relaying guest SSCH/channel programs into fsm_io_request\u2192cp_init); no network, adjacent-radio, or physical-bus handler processes guest channel programs.\nAC:L - Attacker fully controls guest channel program layout and can chain many unique TIC targets so ccwchain_handle_ccw()/ccwchain_loop_tic() recurse without bound until host kernel stack exhaustion; no race, timing, or uncontrollable memory layout is required.\nPR:N - A malicious VM guest with an assigned vfio-ccw mediated subchannel needs no host credentials or capabilities; it only issues guest I/O that QEMU forwards, requiring none of the administrator privileges used to create the mdev.\nUI:N - Exploitation requires only the attacker\u0027s own guest channel program submission through normal passthrough I/O; no separate victim mount, click, or user action is needed once the device is assigned.\nS:C - Guest-supplied channel programs are parsed recursively in host kernel cp_init(), so stack corruption crosses the guest-to-host VFIO device-passthrough boundary and can compromise the hypervisor and co-resident VMs.\nC:H - Unbounded recursion corrupts the host kernel stack frame, enabling disclosure of adjacent stack/kernel memory and supporting further exploitation beyond a mere crash.\nI:H - Stack overflow in ccwchain_handle_ccw() yields attacker-influenced host kernel stack corruption plausibly enabling control-flow hijacking and arbitrary host kernel code execution.\nA:H - Deep recursion reliably causes host kernel stack exhaustion, oops, or panic, crashing the hypervisor and all VMs on the system at guest will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:42.432Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15fb4559a7fdf0b8725e433a71cfd03a1313a48b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1625f66eaa1200068a0e2c05bc90e65182fc4e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ee94790490ae8dcc97df8597f07836c8a81bbcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5405c90d6a47b3014e74ee0618a162449abbbc93"
        }
      ],
      "title": "s390/vfio_ccw: Limit the number of channel program segments",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80554",
    "datePublished": "2026-08-26T14:37:22.376Z",
    "dateReserved": "2026-08-26T14:34:25.766Z",
    "dateUpdated": "2026-08-27T05:01:42.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-80554

CVE-2026-80554 (GCVE-0-2026-80554)

Tags

Sightings

Nomenclature