HIGH Introduced in 5.2
vfio_ccw RegionIndex OOB
CVE-2026-80552
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI8.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced.
02KernelScan AI Analysis
Risk summary
An out-of-bounds array access in the s390 VFIO-CCW mediated device driver allows a VM guest with a passed-through channel I/O device to read or write kernel memory on the host. This is exploitable as a virtual machine escape on s390 systems running KVM with VFIO-CCW device passthrough. The bug requires no race conditions or special privileges beyond having the VFIO device assigned.
Vulnerability analysis
The VFIO-CCW mediated device driver fails to validate the region index before using it to access an internal array of region descriptors during read and write operations. When support for extended device regions was added, bounds checking was applied to the information-querying path but was omitted from the actual read and write paths, allowing a caller-supplied index to reach beyond the allocated array and access arbitrary kernel memory. The fix adds an explicit bounds check against the number of registered regions and hardens the index handling in all read and write paths. This is reachable from a virtual machine guest on s390 systems where a VFIO-CCW device has been assigned; the guest can influence the region index through normal device interactions, making this a potential VM-to-host escape. No special privileges are needed beyond the device being assigned by the host administrator.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.2 | 5.15.218 | 3acbedf5c0b8 |
| 6.1 | 5.2 | 6.1.184 | d3b1e38404b2 |
| 6.6 | 5.2 | 6.6.153 | 79ea5e0c4c8a |
| 6.12 | 5.2 | 6.12.105 | d597fa127380 |
| 6.18 | 5.2 | 6.18.46 | 649badf3a2fd |
| 7.1 | 5.2 | 7.1.10 | 988d9b5be3c2 |
| mainline | 5.2 | 7.2 | 9f5f9a78fedc |
| cip/6.1 | 5.2 | 6.1.187-cip60 | d3b1e38404b2 |
| cip/6.12 | 5.2 | 6.12.108-cip31 | d597fa127380 |