CVE-2026-80550: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80550 Overview

CVE-2026-80550 is an out-of-bounds read vulnerability in the Linux kernel's s390/vfio_ccw subsystem. The flaw resides in ccwchain_calc_length(), which counts the channel command words (CCWs) chained together in a single channel program on IBM Z (s390) systems. The routine rejects chains longer than CCWCHAIN_LEN_MAX (256), but the do..while (count < 257) loop inspects a potential 257th CCW before returning the error. This causes a read of memory outside the intended array bounds.

Critical Impact
A local unprivileged user on an s390 host with vfio-ccw passthrough can trigger an out-of-bounds read in kernel memory, leading to information exposure or limited denial of service. [CWE-125]

Affected Products

Linux kernel builds for s390/IBM Z with CONFIG_VFIO_CCW enabled
Distributions shipping affected stable kernel branches referenced in the upstream stable commits
KVM hosts using vfio-ccw channel-I/O passthrough to guests

Discovery Timeline

2026-08-26 - CVE-2026-80550 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80550

Vulnerability Analysis

The s390/vfio_ccw driver mediates channel-I/O access from userspace and KVM guests to real s390 devices. Before submitting a translated channel program to hardware, the kernel walks the CCW chain to validate length and structure using ccwchain_calc_length().

The function iterates over the caller-supplied chain and enforces the CCWCHAIN_LEN_MAX limit of 256 CCWs. The loop condition allows the counter to reach 257 before terminating. As a result, the code dereferences and inspects a 257th CCW entry, which sits one element past the maximum legal array position, before the length check rejects the chain.

The access is confined to a bounded overrun of one CCW structure, but the read is attacker-influenced and can cross into adjacent kernel memory. The bug affects only s390 architecture kernels compiled with vfio-ccw support.

Root Cause

The defect is a classic off-by-one in loop termination logic. Because is_cpa_within_range() adjusts between 0-indexed array positions and 1-based counts, the outer loop must stop after examining index 255. The original while (count < 257) predicate allows one extra iteration that reads index 256, producing an out-of-bounds access before the error return.

Attack Vector

Exploitation requires local access to an s390 system with vfio-ccw passthrough exposed, typically a KVM host granting a guest or process control of a mediated channel device. An attacker crafts a channel program with 256 chained CCWs so that the traversal reaches the boundary condition. The upstream patch restructures the loop to break as soon as 256 CCWs have been examined, preventing any read beyond index 255. Refer to the upstream fix commit 907adc6 for the corrected loop structure.

Detection Methods for CVE-2026-80550

Indicators of Compromise

Kernel log entries from the vfio_ccw subsystem referencing rejected or oversized channel programs on s390 hosts
KASAN or slab-out-of-bounds reports implicating ccwchain_calc_length in the call trace
Unexpected termination or I/O errors from guests using mediated CCW devices

Detection Strategies

Inventory s390/IBM Z hosts running kernels without the fix commits (907adc6, 0282fb1, 499a8a6, 4c2e1d3, a005b7f, af3f80c, d5d096c, f20be33)
Enable KASAN on test kernels to catch out-of-bounds reads during vfio-ccw fuzzing or QA
Correlate guest-issued channel programs with host dmesg warnings from the cio and vfio_ccw modules

Monitoring Recommendations

Forward s390 host kernel logs to a central log platform and alert on repeated vfio_ccw chain-length rejections from the same guest or process
Track kernel package versions across s390 fleets to confirm patched builds are deployed
Monitor mediated device (mdev) creation and assignment events for unexpected consumers of vfio_ccw

How to Mitigate CVE-2026-80550

Immediate Actions Required

Update Linux kernels on all affected s390/IBM Z hosts to a stable release containing the fix commits listed in the NVD references
Restrict which users and guests can attach to vfio-ccw mediated devices, limiting local attack surface
Audit KVM guest configurations to identify all instances of channel-I/O passthrough

Patch Information

The fix rewrites the CCW traversal loop to terminate strictly after 256 iterations, ensuring no read past index 255. The change is available in multiple stable branches through commits 0282fb1, 499a8a6, 4c2e1d3, 907adc6, a005b7f, af3f80c, d5d096c, and f20be33. Apply vendor kernel updates from your distribution as soon as they are available.

Workarounds

Disable vfio_ccw on hosts that do not require channel-I/O passthrough by unloading the module and blacklisting it
Remove or unbind mediated CCW devices from untrusted guests until patched kernels are installed
Enforce strict access controls on /dev/vfio/* so that only trusted management processes can open mediated devices

bash

# Configuration example: temporarily disable vfio_ccw on an s390 host
sudo modprobe -r vfio_ccw
echo "blacklist vfio_ccw" | sudo tee /etc/modprobe.d/blacklist-vfio-ccw.conf
sudo update-initramfs -u

# Verify installed kernel includes the fix
uname -r
rpm -q --changelog kernel | grep -i "vfio_ccw\|ccwchain_calc_length"