Look up another CVE · open CVE-2026-80547 in the interactive tracker
CVE-2026-80547
s390/vfio_ccw: Implement a crw lock
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem drivers/s390. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-80547 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/s390/cio/vfio_ccw_chp.c
drivers/s390/cio/vfio_ccw_drv.c
drivers/s390/cio/vfio_ccw_ops.c
drivers/s390/cio/vfio_ccw_private.h
- What this is
- S390 VFIO-CCW DRIVERMAINTAINERS section matched on drivers/s390/cio/vfio_ccw* · linux-s390@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_S390|CONFIG_VFIO_CCW' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_S390, CONFIG_VFIO_CCW
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/s390
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.8 | 5.15.218 | 3c94d4179bcc |
| 5.8 | 6.1.185 | 0edd222730a9 |
| 5.8 | 6.6.154 | a3d60ae24183 |
| 5.8 | 6.12.105 | 49fa26b0df00 |
| 5.8 | 6.18.46 | 7902be374cbf |
| 5.8 | 7.1.10 | c76c4ee72bfc |
| 5.8 | 7.2 | 16b0798024c0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is reached only via local VFIO mediated-device access (read/ioctl on /dev/vfio/* device fds) to the CCW CRW region; vfio-ccw has no network, Bluetooth, or physical-bus packet entry point.
- AC:LAttack complexity, low
- The attacker controls CRW region reads and can retry concurrently while channel-path events queue CRWs via vfio_ccw_chp_event(); this user-versus-hardware/workqueue list race is winnable without conditions outside attacker influence.
- PR:LPrivileges required, low
- Triggering requires an opened vfio-ccw mdev fd (typical QEMU/libvirt VM operator or delegated /dev/vfio holder on IBM Z passthrough hosts), not init-namespace root; admin creates the mdev but exploitation needs only that VFIO client access.
- UI:NUser interaction, none
- No separate victim action is required; once vfio-ccw passthrough is configured, the attacker repeatedly reads the CRW region while guest/channel I/O generates asynchronous path events without needing another user to interact.
- S:CScope, changed
- On IBM Z/LinuxONE, vfio-ccw passes DASD subchannels into KVM guests; guest-driven channel activity causes host-side CRW queuing while the VFIO client reads the CRW region, corrupting hypervisor kernel memory outside the VM security boundary.
- C:HConfidentiality impact, high
- Unsynchronized list_del/list_add/kfree on kmalloc vfio_ccw_crw objects is a use-after-free/list-corruption primitive; per kernel guidance this enables attacker-influenced heap reuse and arbitrary kernel memory disclosure.
- I:HIntegrity impact, high
- Corrupted list pointers and freed CRW entries allow heap-sprayable arbitrary writes and control-flow hijack beyond a simple crash, matching kernel guidance for use-after-free and memory corruption bugs.
- A:HAvailability impact, high
- Concurrent unsynchronized list manipulation can immediately oops or panic the host kernel via invalid list operations or double-free, and successful exploitation can hang or crash the entire system.