HIGH Introduced in 5.8
vfio_ccw CrwList Race
CVE-2026-80547
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively.
02KernelScan AI Analysis
Risk summary
A race condition in the s390 vfio-ccw driver allows concurrent access to the CRW (Channel Report Word) list without proper synchronization. This can lead to list corruption or use-after-free when hardware events and userspace reads occur simultaneously, potentially causing a kernel crash or denial of service.
Vulnerability analysis
The vfio-ccw driver maintains a list of Channel Report Word (CRW) entries that are populated by asynchronous hardware events and consumed by userspace reads. Without a dedicated lock, the list can be modified concurrently by the hardware event path and the userspace read path, leading to list corruption or use-after-free of CRW entries. The fix introduces a spinlock that serializes all access to the CRW list, ensuring entries are added, removed, and freed cohesively. This vulnerability is reachable on s390 systems with vfio-ccw configured, requiring a user with access to the mediated vfio-ccw device and hardware generating channel report events.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.8 | 5.15.218 | 3c94d4179bcc |
| 6.1 | 5.8 | 6.1.185 | 0edd222730a9 |
| 6.12 | 5.8 | 6.12.105 | 49fa26b0df00 |
| 6.18 | 5.8 | 6.18.46 | 7902be374cbf |
| 6.6 | 5.8 | 6.6.154 | a3d60ae24183 |
| 7.1 | 5.8 | 7.1.10 | c76c4ee72bfc |
| mainline | 5.8 | 7.2 | 16b0798024c0 |
| cip/6.1 | 5.8 | 6.1.187-cip60 | 0edd222730a9 |
| cip/6.1-rt | 5.8 | 6.1.189-cip61-rt32 | 0edd222730a9 |
| cip/6.12 | 5.8 | 6.12.108-cip31 | 49fa26b0df00 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |