HIGH Introduced in 4.12
vfio_ccw WorkQueue UAF
CVE-2026-80553
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd.
02KernelScan AI Analysis
Risk summary
A use-after-free race in the s390 vfio_ccw driver allows a local attacker with access to a mediated channel I/O device to trigger work items after the internal device data is freed, potentially leading to kernel memory corruption or a crash. Exploitation requires s390 hardware with vfio_ccw configured and access to the mediated device, limiting practical risk to specific mainframe deployments.
Vulnerability analysis
The driver creates background work items to finish I/O and handle channel events, but fails to cancel them when the mediated device is closed or released. If a work item is still pending when the device's internal data is torn down, the worker will access freed kernel memory, leading to heap corruption. The fix cancels both workqueues during device shutdown and re-open so no pending work runs after the data is gone. A local process that can open and close a vfio_ccw mediated device on s390 hardware can reach this path, which generally requires the device to be assigned to the attacker's context through VFIO.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.12 | 5.10.267 | 87d569cb35a5 |
| 5.15 | 4.12 | 5.15.218 | 7492ca2d0c5d |
| 6.1 | 4.12 | 6.1.185 | b94b28c1f0fa |
| 6.12 | 4.12 | 6.12.105 | dc47a98abe67 |
| 6.18 | 4.12 | 6.18.46 | b7ae0f799386 |
| 6.6 | 4.12 | 6.6.153 | e868ea8be0bc |
| 7.1 | 4.12 | 7.1.10 | 77f5e888d2e6 |
| mainline | 4.12 | 7.2 | 79c60b2c6110 |
| cip/5.10 | 4.12 | 5.10.268-cip77 | 87d569cb35a5 |
| cip/5.10-rt | 4.12 | 5.10.268-cip77-rt34 | 87d569cb35a5 |
| cip/6.1 | 4.12 | 6.1.187-cip60 | b94b28c1f0fa |
| cip/6.1-rt | 4.12 | 6.1.189-cip61-rt32 | b94b28c1f0fa |
| cip/6.12 | 4.12 | 6.12.108-cip31 | dc47a98abe67 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |