HIGH Introduced in 5.3
vfio_ccw ChannelProgram Leak
CVE-2026-80555
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.
02KernelScan AI Analysis
Risk summary
A memory leak in the s390 vfio-ccw driver allows a guest VM to exhaust host memory by repeatedly submitting malformed channel programs that fail during initialization. The incomplete error cleanup frees only the current CCW chain segment while leaking other segments allocated via Transfer in Channel. This affects IBM mainframe hosts using vfio-ccw device passthrough to virtual machines.
Vulnerability analysis
When a guest VM submits a channel program to a passed-through CCW device, the host kernel builds a chain of CCW segments, some created via Transfer in Channel. If initialization fails partway through, the error cleanup path frees only the currently-processed segment, leaving all other allocated segments leaked on the host. A guest can repeat this to gradually exhaust host memory. The fix moves cleanup out of the recursive chain-building logic so that on any failure, all segments accumulated so far are freed by iterating the full chain list. The attack surface is limited to s390 mainframe hosts configured for vfio-ccw device passthrough; a guest VM with an assigned CCW device can trigger this without any host-level privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.3 | 5.10.267 | 276bd7ed34d5 |
| 5.15 | 5.3 | 5.15.218 | f9bcff265556 |
| 6.1 | 5.3 | 6.1.185 | 17e01e342af7 |
| 6.12 | 5.3 | 6.12.105 | 6a917199aaf9 |
| 6.18 | 5.3 | 6.18.46 | 32e3d364a7b8 |
| 6.6 | 5.3 | 6.6.154 | 152fcb74a268 |
| 7.1 | 5.3 | 7.1.10 | 4699b54fada1 |
| mainline | 5.3 | 7.2 | 74186c2968f8 |
| cip/5.10 | 5.3 | 5.10.268-cip77 | 276bd7ed34d5 |
| cip/5.10-rt | 5.3 | 5.10.268-cip77-rt34 | 276bd7ed34d5 |
| cip/6.1 | 5.3 | 6.1.187-cip60 | 17e01e342af7 |
| cip/6.1-rt | 5.3 | 6.1.189-cip61-rt32 | 17e01e342af7 |
| cip/6.12 | 5.3 | 6.12.108-cip31 | 6a917199aaf9 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |