CRITICAL Introduced in 5.3
vfio_ccw IDAW TOCTOU
CVE-2026-80551
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with.
02KernelScan AI Analysis
Risk summary
A guest VM on s390 can race the kernel's two reads of the first IDAW address in a channel program, causing the kernel to translate a stale address and corrupt or misdirect host memory I/O. The bug is reachable from any guest with access to a vfio-ccw passthrough channel device and requires no special guest privileges.
Vulnerability analysis
The host kernel reads a guest-supplied address pointer twice while preparing a channel program for a passed-through device: once to calculate buffer size and again when building the address list. A guest virtual machine can alter that pointer between the two reads, leaving the host with mismatched size and address information so that it may set up incorrect direct-memory access. The fix records the pointer from the first read and aborts the operation if the value has changed when read the second time, guaranteeing a consistent view. Only s390 systems that assign channel I/O devices to guest virtual machines through vfio-ccw are exposed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.3 | 6.12.105 | 0d46c2565f17 |
| 6.18 | 5.3 | 6.18.46 | 08ef2a821156 |
| 6.6 | 5.3 | 6.6.154 | 460b977a4e71 |
| 7.1 | 5.3 | 7.1.10 | fc59e9482117 |
| mainline | 5.3 | 7.2 | 565bef268d75 |
| cip/6.12 | 5.3 | 6.12.108-cip31 | 0d46c2565f17 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |