CVE-2026-80547: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80547 Overview

CVE-2026-80547 is a race condition vulnerability in the Linux kernel's s390/vfio_ccw subsystem. The Channel-Report-Word (CRW) region in vfio_ccw handles asynchronous hardware events without proper synchronization. Unlike the channel_program struct that covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events from hardware. The absence of a lock over the list of CRW payloads allows concurrent access that can corrupt state when userspace reads CRW data. The upstream fix implements a dedicated CRW lock to ensure payloads are read cohesively.

Critical Impact
A local, low-privileged user on an s390 (IBM Z) system with access to a passthrough vfio_ccw device can trigger the race to achieve high-impact effects on confidentiality, integrity, and availability across a security scope boundary.

Affected Products

Linux kernel s390/vfio_ccw subsystem (IBM Z architecture)
Distributions shipping affected mainline and stable kernels prior to the patch commits
Virtualization stacks that expose Channel Control Word (CCW) devices via VFIO passthrough

Discovery Timeline

2026-08-26 - CVE-2026-80547 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80547

Vulnerability Analysis

The vfio_ccw driver on s390 exposes CCW-based devices to userspace virtual machines. It provides multiple regions, including the CRW region, which surfaces Channel Report Words generated asynchronously by the hardware. The channel_program structure already accounted for concurrency between synchronous I/O submissions and asynchronous interrupts. The CRW region did not have equivalent protection. Multiple asynchronous hardware events can queue payloads on the CRW list at the same time userspace consumes them. Without a lock, list traversal and mutation interleave, resulting in inconsistent reads, use-after-free of freed payload nodes, or list corruption. The upstream resolution introduces a dedicated crw lock that serializes producer and consumer access to the list.

Root Cause

The root cause is missing synchronization on a shared list of CRW payloads that is concurrently produced by hardware event handlers and consumed by userspace read paths. This is a classic race condition in kernel data structure access. The scope change reflected in the CVSS vector indicates that exploitation crosses the guest-to-host boundary imposed by the VFIO passthrough model.

Attack Vector

Exploitation requires local access with low privileges to a host that exposes a vfio_ccw device, typically a virtualization host or a guest granted passthrough. An attacker triggers or waits for CRW-generating hardware events while repeatedly reading the CRW region through the VFIO file descriptor. The interleaved access races the list operations, producing memory corruption or inconsistent state that can be leveraged for privilege escalation or host destabilization. No user interaction is required. See the kernel stable commits referenced in Kernel Git Commit #a3d60ae and Kernel Git Commit #c76c4ee for the corrective changes.

No public proof-of-concept is available. Refer to the upstream commits for the precise code paths involved.

Detection Methods for CVE-2026-80547

Indicators of Compromise

Unexpected kernel oops, list_add corruption, or list_del corruption warnings originating in drivers/s390/cio/vfio_ccw* code paths
Crashes or hangs on s390 hosts that expose vfio_ccw mediated devices to guests
Guest processes issuing high-frequency read() calls against vfio_ccw CRW region file descriptors

Detection Strategies

Inventory s390 hosts running kernels prior to the fix commits and correlate with kernels that ship vfio_ccw passthrough enabled
Monitor kernel logs (dmesg, journalctl -k) for warnings and stack traces referencing vfio_ccw, crw, or list debugging assertions
Baseline expected access patterns to /dev/vfio/* file descriptors and alert on anomalous read volumes from guest workloads

Monitoring Recommendations

Ingest kernel and audit logs from IBM Z hosts into a centralized analytics platform for correlation across the fleet
Track kernel package versions on s390 systems and compare against the fixed stable release tags referenced in the commits above
Alert on new or unexpected vfio_ccw device bindings, which indicate expansion of the attack surface

How to Mitigate CVE-2026-80547

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the CRW lock fix to all s390 systems using vfio_ccw
Restrict which users and virtual machines can bind or access vfio_ccw mediated devices until patching is complete
Audit guests that receive CCW device passthrough and remove passthrough where operationally unnecessary

Patch Information

The fix is available in the mainline and multiple stable branches. Relevant commits include Kernel Git Commit #0edd222, Kernel Git Commit #16b0798, Kernel Git Commit #3c94d41, Kernel Git Commit #49fa26b, Kernel Git Commit #7902be3, Kernel Git Commit #a3d60ae, and Kernel Git Commit #c76c4ee. Consume the fix through your distribution's kernel update channel.

Workarounds

Unbind vfio_ccw from CCW devices that are not required for production workloads to eliminate the vulnerable code path
Do not grant untrusted local users access to /dev/vfio/* on s390 hosts running affected kernels
Where feasible, migrate sensitive workloads off shared s390 hosts exposing vfio_ccw until the patch is deployed

bash

# Verify running kernel and check for vfio_ccw usage on s390 hosts
uname -m && uname -r
lsmod | grep vfio_ccw
ls -l /sys/bus/mdev/drivers/vfio_mdev/ 2>/dev/null
# Unbind a specific device (replace <mdev-uuid>) if passthrough is not required
echo <mdev-uuid> > /sys/bus/mdev/drivers/vfio_mdev/unbind