CVE-2026-80550

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only via local VFIO-ccw mediated-device write() on the I/O region (guest channel program relayed by QEMU into fsm_io_request→cp_init→ccwchain_calc_length); vfio-ccw has no network, adjacent-radio, or physical-bus entry point.

AC:LAttack complexity, low

An attacker fully controls guest channel program content and can reliably submit 256 command-chained CCWs so ccwchain_calc_length() reaches the 257th iteration; no race, special timing, or uncontrollable heap layout is required beyond crafting the CCW chain.

PR:NPrivileges required, none

A malicious KVM guest with an assigned vfio-ccw mediated subchannel needs no host credentials or capabilities; it triggers the bug by issuing normal guest I/O that QEMU forwards through VFIO, without init-namespace root or admin setup privileges at exploit time.

UI:NUser interaction, none

Exploitation requires only the attacker's own channel program submission through VFIO passthrough I/O once the device is assigned; no separate victim mount, click, or other user action is needed.

S:CScope, changed

Guest-supplied channel programs are parsed in the host kernel cp_init() path during vfio-ccw device passthrough on IBM Z/LinuxONE, so the out-of-bounds read crosses the guest-to-host VFIO virtualization boundary and can compromise hypervisor memory outside the VM security scope.

C:HConfidentiality impact, high

ccwchain_calc_length() reads one struct ccw1 (8 bytes) past the 256-element guest_cp kmalloc buffer when all CCWs are chained, constituting a kernel heap out-of-bounds read of adjacent slab memory that per kernel guidance enables information disclosure primitives.

I:NIntegrity impact, none

The vulnerability is a single out-of-bounds read used only for chain/TIC validation before returning -EINVAL; it performs no out-of-bounds write and does not modify host or guest data, channel program state, or kernel control structures on the error path.

A:LAvailability impact, low

The out-of-bounds read typically does not crash production kernels because the access stays within the same kmalloc slab page, but KASAN-instrumented or hardened builds can detect it and fault; availability impact is limited rather than a reliable host panic.