CVE-2026-80549 Overview
CVE-2026-80549 affects the Linux kernel's s390/vfio_ccw driver on IBM Z (s390) architectures. The flaw resides in the fsm_notoper() routine, which handles device-lost events for VFIO channel command word (CCW) passthrough. The routine executes cleanup of private->cp (channel program) resources while other subsystem locks — notably the Common I/O (CIO) subchannel lock — are held by the calling sequence. Because fsm_notoper() can fire asynchronously from normal driver flow, the cleanup path creates unsafe locking conditions in the kernel. The upstream fix defers cp cleanup to a workqueue so it runs outside the constrained lock context.
Critical Impact
A local attacker with high privileges on an s390 system using vfio_ccw passthrough can trigger unsafe kernel locking behavior, leading to denial of service or corruption of kernel state affecting confidentiality, integrity, and availability.
Affected Products
- Linux kernel — s390/vfio_ccw driver on IBM Z (s390x) architecture
- Kernel builds prior to the commits referenced in the upstream fix series
- KVM hosts on s390 that expose channel devices to guests via VFIO CCW passthrough
Discovery Timeline
- 2026-08-26 - CVE-2026-80549 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80549
Vulnerability Analysis
The vfio_ccw driver implements VFIO passthrough for s390 channel-attached I/O devices. It uses a finite state machine (FSM) to track device state transitions. When a device becomes unavailable, the fsm_notoper() handler runs to mark the device not operational and free associated resources, including the channel program tracked in private->cp.
The issue is that fsm_notoper() executes synchronously from event contexts that already hold the CIO subchannel lock. Freeing the channel program under that lock forces cp teardown into a constrained locking environment. This blocks safe evolution of the driver's locking model and can produce lock-ordering issues during asynchronous device-loss events.
The fix moves the cp cleanup into a workqueue, decoupling it from the caller's lock context so it can run without holding the subchannel lock.
Root Cause
The root cause is improper locking discipline in the FSM cleanup path. Resource release for private->cp is performed inline within fsm_notoper(), but callers of that routine already hold the CIO subchannel lock. This is a kernel driver locking flaw in an asynchronous error-handling path, not a memory-safety bug in isolation, though the constrained context prevents the driver from adopting safer locking for related resources.
Attack Vector
Exploitation requires local access with high privileges on an s390 host running the vfio_ccw driver — typically a KVM hypervisor exposing channel devices to guests. The scope is marked changed because a local operator or guest able to induce asynchronous device-loss events on a passthrough subchannel can trigger the vulnerable cleanup path outside the boundary of the initial component. No verified public exploit is available. The CVE record does not include a proof-of-concept, and no exploitation in the wild has been reported.
The vulnerability manifests in the fsm_notoper() routine within the s390/vfio_ccw subsystem. See the upstream kernel patches for technical details of the corrected cleanup path.
Detection Methods for CVE-2026-80549
Indicators of Compromise
- Kernel log entries referencing vfio_ccw state transitions to not-operational, correlated with lock contention or soft lockup warnings on s390 hosts
- Unexpected subchannel disconnect events for VFIO-passthrough devices tied to guest workloads
- Kernel stack traces implicating fsm_notoper and CIO subchannel lock paths
Detection Strategies
- Inventory s390x hosts and confirm whether the vfio_ccw module is loaded and in use for guest passthrough
- Compare running kernel commit or distribution package version against the fixed commits 0c11f61, 4e3301e, 56100ba, af1759d, c9b85aa, and f98a989
- Monitor dmesg and journald for vfio_ccw FSM warnings and hung-task detector output on affected hosts
Monitoring Recommendations
- Forward s390 host kernel logs to a centralized logging platform and alert on vfio_ccw FSM warnings, hung tasks, and CIO lock stall messages
- Track privileged local access and administrative activity on hypervisors that expose CCW devices to guests
- Baseline subchannel event volume so anomalous device-loss bursts can be flagged for review
How to Mitigate CVE-2026-80549
Immediate Actions Required
- Apply the vendor kernel update from your Linux distribution containing the upstream fix as soon as it is released
- Restrict shell and hypervisor administrative access on s390 hosts to trusted operators only, given the local high-privilege attack vector
- Audit which guests receive VFIO CCW passthrough devices and reduce that exposure where operationally possible
Patch Information
The fix is upstream in the Linux kernel across the following commits: Kernel Patch 0c11f61, Kernel Patch 4e3301e, Kernel Patch 56100ba, Kernel Patch af1759d, Kernel Patch c9b85aa, and Kernel Patch f98a989. These patches move cp cleanup from fsm_notoper() to a workqueue. Track your distribution's security advisories for backports.
Workarounds
- Unload the vfio_ccw module on hosts that do not require CCW passthrough until the kernel is patched
- Remove VFIO CCW device assignments from guests where passthrough is not strictly required
- Enforce least privilege on hypervisor administrative accounts to reduce the pool of actors who can reach the local attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
