{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80549","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.766Z","datePublished":"2026-08-26T14:37:19.353Z","dateUpdated":"2026-08-27T12:40:09.822Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-27T12:40:09.822Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Move cp cleanup out of not operational\n\nThe fsm_notoper() routine is called when the device has been\nlost, and is (by definition) no longer operational. Since this\ncan happen asynchronously from the normal behavior of the\ndriver, the cleanup may happen when holding other locks\nin the calling sequence (notably, the cio subchannel lock).\n\nPush the cleanup of the private->cp resources to a workqueue,\nwhere it can be done out from under that lock sequence and\na future patch can safely manage the locking requirements."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Reachable only via local VFIO/mdev device access (pread/pwrite/ioctl on an opened vfio-ccw mediated device); the vulnerable cp_free() runs from FSM not-operational handling triggered by CIO subchannel events and VFIO I/O, not from any network protocol.\nAC:L - A VFIO client can submit channel programs and concurrently provoke not-operational transitions (device close/reset, in-flight I/O, or subchannel state changes), controlling both sides of the race without rare external timing.\nPR:H - Exploitation requires opening and operating an s390 vfio-ccw passthrough mdev, which needs host administrator setup and CAP_SYS_ADMIN-level VFIO/IOMMU access that cannot be obtained from an unprivileged user namespace.\nUI:N - No victim interaction is required beyond the attacker already having VFIO device access; triggering the bug is fully automated through concurrent I/O submissions and device state transitions.\nS:C - vfio-ccw manages guest DMA page pinning/unpinning through the IOMMU for channel I/O passthrough; unsynchronized cp_free() under the wrong locks can corrupt that isolation boundary between the VFIO guest and the host kernel.\nC:H - Concurrent unsynchronized cp_free() on an active channel_program can double-free or use-after-free kmalloc'd ccwchain/page_array metadata and pinned page state, yielding kernel memory disclosure primitives per UAF guidance.\nI:H - The same race while unpining guest pages and freeing channel-program structures can corrupt heap metadata and IOMMU mappings, enabling arbitrary kernel write or control-flow hijack per memory-corruption guidance.\nA:H - Calling sleeping vfio_unpin_pages()/cp_free() while holding the subchannel spinlock can deadlock the kernel, and the concurrent double-free/UAF reliably causes kernel oops/panic under load."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/s390/cio/vfio_ccw_drv.c","drivers/s390/cio/vfio_ccw_fsm.c","drivers/s390/cio/vfio_ccw_ops.c","drivers/s390/cio/vfio_ccw_private.h"],"versions":[{"version":"204b394a23ad5e30944f23518e21e844614da2ff","lessThan":"c9b85aa2cf73ea645e55e2c2670e0ddebfe1589b","status":"affected","versionType":"git"},{"version":"204b394a23ad5e30944f23518e21e844614da2ff","lessThan":"f98a9890ca42f4223d2d4c50e0660af3e012fcb4","status":"affected","versionType":"git"},{"version":"204b394a23ad5e30944f23518e21e844614da2ff","lessThan":"4e3301e2a651d742c05914f6074a25b8e41bce19","status":"affected","versionType":"git"},{"version":"204b394a23ad5e30944f23518e21e844614da2ff","lessThan":"af1759d8e6e6da9ba94f30a2f92546f406899aa7","status":"affected","versionType":"git"},{"version":"204b394a23ad5e30944f23518e21e844614da2ff","lessThan":"56100baa0eb7055b1026dfa73e696e8066ff71fd","status":"affected","versionType":"git"},{"version":"204b394a23ad5e30944f23518e21e844614da2ff","lessThan":"0c11f61a876ed6fcca53d442ed3f33ea8362a0f9","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/s390/cio/vfio_ccw_drv.c","drivers/s390/cio/vfio_ccw_fsm.c","drivers/s390/cio/vfio_ccw_ops.c","drivers/s390/cio/vfio_ccw_private.h"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"6.1.185","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.10","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.185"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c9b85aa2cf73ea645e55e2c2670e0ddebfe1589b"},{"url":"https://git.kernel.org/stable/c/f98a9890ca42f4223d2d4c50e0660af3e012fcb4"},{"url":"https://git.kernel.org/stable/c/4e3301e2a651d742c05914f6074a25b8e41bce19"},{"url":"https://git.kernel.org/stable/c/af1759d8e6e6da9ba94f30a2f92546f406899aa7"},{"url":"https://git.kernel.org/stable/c/56100baa0eb7055b1026dfa73e696e8066ff71fd"},{"url":"https://git.kernel.org/stable/c/0c11f61a876ed6fcca53d442ed3f33ea8362a0f9"}],"title":"s390/vfio_ccw: Move cp cleanup out of not operational","x_generator":{"engine":"bippy-1.2.0"}}}}