vfio_ccw RegionIndex OOB

Vulnerability analysis

The VFIO-CCW mediated device driver fails to validate the region index before using it to access an internal array of region descriptors during read and write operations. When support for extended device regions was added, bounds checking was applied to the information-querying path but was omitted from the actual read and write paths, allowing a caller-supplied index to reach beyond the allocated array and access arbitrary kernel memory. The fix adds an explicit bounds check against the number of registered regions and hardens the index handling in all read and write paths. This is reachable from a virtual machine guest on s390 systems where a VFIO-CCW device has been assigned; the guest can influence the region index through normal device interactions, making this a potential VM-to-host escape. No special privileges are needed beyond the device being assigned by the host administrator.