CVE-2026-80548 Overview
CVE-2026-80548 is a race condition vulnerability in the Linux kernel's s390/vfio_ccw subsystem. The io_mutex was originally defined to serialize io_regions operations but became loosely associated with I/O operations themselves. Several race windows remained where concurrent execution paths could interact incorrectly with shared I/O resources. The kernel maintainers resolved the issue by selectively expanding the scope of io_mutex to close these windows. The fix also leverages a workqueue element for cp_free() invoked from fsm_notoper(), since that path can run in interrupt context and cannot acquire a mutex directly.
Critical Impact
A local, low-privileged user on an s390 system exposing the vfio_ccw driver can trigger race conditions leading to high-impact confidentiality, integrity, and availability effects across security scopes.
Affected Products
- Linux kernel with the s390/vfio_ccw driver enabled
- IBM Z (s390x) systems using channel I/O passthrough via VFIO
- KVM hosts on s390x exposing CCW devices to guests
Discovery Timeline
- 2026-08-26 - CVE-2026-80548 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80548
Vulnerability Analysis
The vfio_ccw driver on s390 provides userspace access to channel command word (CCW) devices for virtualization workloads. The driver uses io_mutex to serialize access to io_regions, which are memory-mapped regions exposed to userspace for issuing I/O. Over time, the same mutex became implicitly relied upon to protect the underlying I/O state due to the close relationship between the regions and the I/O they describe.
Several race conditions [Race Condition] remained where concurrent operations, such as userspace issuing new I/O while a state machine transition or interrupt-context callback ran, could observe or modify inconsistent state. This class of concurrency defect can lead to memory corruption, use-after-free conditions, or inconsistent device state during teardown.
Root Cause
The root cause is insufficient locking scope. io_mutex was originally scoped to io_regions only, leaving I/O resource accesses partially unprotected. Maintainers chose to expand io_mutex coverage rather than introduce a second lock, avoiding the added complexity of maintaining a correct lock hierarchy.
Attack Vector
Exploitation requires local access with low privileges on a system where the vfio_ccw driver is loaded and a CCW device is bound to it. An attacker with the ability to interact with the VFIO device file descriptor can trigger the race by concurrently issuing I/O operations and state changes. Successful exploitation impacts a scope beyond the initial component, consistent with a VFIO userspace-to-kernel boundary crossing.
No verified exploit code is available. See the upstream stable commit for the corrective patch.
Detection Methods for CVE-2026-80548
Indicators of Compromise
- Unexpected kernel warnings or oops messages referencing vfio_ccw, fsm_notoper, or cp_free in dmesg and /var/log/messages.
- Kernel panics on s390x hosts running QEMU/KVM guests that use CCW passthrough.
- Guest VMs unexpectedly losing access to passthrough CCW devices under high I/O load.
Detection Strategies
- Inventory s390x Linux hosts and identify those with CONFIG_VFIO_CCW=y or the vfio_ccw module loaded via lsmod | grep vfio_ccw.
- Compare running kernel versions against the fixed commits listed in the upstream references to identify unpatched systems.
- Monitor kernel ring buffer telemetry for repeated soft lockups or lock debugging output tied to io_mutex.
Monitoring Recommendations
- Forward dmesg, journald, and audit logs from s390x hosts to a centralized log platform for correlation.
- Alert on kernel oops, WARN_ON, or lockdep splats originating from the drivers/s390/cio/ code paths.
- Track local privilege escalation attempts against user accounts with access to /dev/vfio/* device nodes.
How to Mitigate CVE-2026-80548
Immediate Actions Required
- Apply the vendor-supplied kernel update containing the upstream fixes referenced in the CVE metadata.
- Restrict access to /dev/vfio/* device nodes to only trusted virtualization service accounts.
- Audit which workloads on s390x hosts require CCW passthrough and remove the driver from systems that do not.
Patch Information
The fix is present in the following upstream Linux kernel commits: 2a5ac0c0f1f7, 2ba9efdf9ebe, 34f4feff3e90, 56d7488533ce, b6aecea4b2b2, dab6a6627b0b, and f72a51810d49. Update to a distribution kernel that has backported these changes.
Workarounds
- Unload the vfio_ccw module on hosts that do not require CCW passthrough using modprobe -r vfio_ccw and blacklist it.
- Limit membership of the vfio group and tighten permissions on VFIO device files to prevent untrusted local access.
- Where feasible, migrate guests off affected hosts until patched kernels are deployed.
# Configuration example
# Blacklist the vfio_ccw module on systems that do not need CCW passthrough
echo 'blacklist vfio_ccw' | sudo tee /etc/modprobe.d/blacklist-vfio_ccw.conf
sudo modprobe -r vfio_ccw
# Restrict access to VFIO device nodes
sudo chown root:vfio /dev/vfio/*
sudo chmod 0660 /dev/vfio/*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
