CVE-2026-80551 Overview
CVE-2026-80551 is a race condition vulnerability in the Linux kernel's s390/vfio_ccw driver. The flaw affects how the driver reads the first Indirect Data Address Word (IDAW) in an Indirect Data Address List (IDAL). The first IDAW is read separately from subsequent entries because it does not require 2K/4K boundary alignment. Without verification that the address remains constant between reads, an attacker with local access can alter the value between the two reads, producing an inconsistent view of the IDAW set.
Critical Impact
Local attackers on s390 systems using vfio_ccw pass-through can trigger memory corruption in the kernel, leading to privilege escalation, data disclosure, or host denial of service.
Affected Products
- Linux kernel s390 architecture builds with CONFIG_VFIO_CCW enabled
- Distributions shipping kernels prior to the fixes referenced in commits 08ef2a8, 0d46c25, 460b977, 565bef2, and fc59e94
- IBM Z / LinuxONE hosts exposing channel-attached devices to guests via vfio_ccw
Discovery Timeline
- 2026-08-26 - CVE-2026-80551 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80551
Vulnerability Analysis
The vfio_ccw driver enables IBM Z guests to pass channel command words (CCWs) directly to channel-attached devices. When a CCW references an IDAL, the kernel must translate each IDAW into a host-accessible buffer.
The first IDAW in the list is a special case. Unlike subsequent IDAWs, it is not required to fall on a 2K or 4K page boundary, so the driver reads it separately to compute the exact size of the buffer required for the full IDAL. This creates a Time-of-Check to Time-of-Use (TOCTOU) window between the initial read of the first IDAW and the subsequent read of the remaining entries.
If the value at that address changes between reads, the kernel operates on an inconsistent IDAW set. The buffer size calculated from the first read no longer reflects the addresses used by later processing steps, resulting in memory corruption within kernel context.
Root Cause
The root cause is a missing consistency check on shared user-controlled memory. The driver treated the first IDAW as a stable input despite reading it from memory writable by the guest. Without re-verifying that the address is unchanged, subsequent operations trust a stale size calculation.
Attack Vector
Exploitation requires local access to a system running an affected kernel with vfio_ccw pass-through configured. A privileged guest user or attacker with control over IDAL contents races the kernel by modifying the first IDAW entry between the two reads. The scope-changed CVSS vector reflects that a guest-side attacker can impact the host kernel.
No synthetic proof-of-concept code is published. See Kernel Git Commit 460b977 and the related backports for the exact patch logic.
Detection Methods for CVE-2026-80551
Indicators of Compromise
- Unexpected kernel oops or panic traces referencing vfio_ccw, ccwchain, or IDAL translation functions on s390 hosts
- Guest workloads issuing high volumes of channel programs with IDAL-flagged CCWs to trigger the race
- Kernel log entries showing translation failures or inconsistent buffer sizes from the vfio_ccw subsystem
Detection Strategies
- Inventory s390 hosts and confirm which kernels include the commits 08ef2a8, 0d46c25, 460b977, 565bef2, or fc59e94
- Audit which guests are granted vfio_ccw device pass-through and treat those guests as elevated-risk
- Correlate host kernel crash events with guest activity windows to identify race attempts
Monitoring Recommendations
- Ship kernel ring buffer (dmesg) and journalctl -k output to a centralized log store for anomaly review
- Alert on repeated vfio_ccw warnings, translation errors, or unexpected guest terminations
- Monitor host stability metrics (unplanned reboots, kernel panics) on LPARs running vfio_ccw workloads
How to Mitigate CVE-2026-80551
Immediate Actions Required
- Apply the vendor-provided kernel update that includes the upstream fix from commit 460b977a4e71cc319fdadf91c193ec3beaa57263 and its stable backports
- Restrict vfio_ccw device pass-through to trusted guests and administrators only
- Reboot affected s390 hosts to activate the patched kernel image
Patch Information
The fix modifies the vfio_ccw IDAL translation path to re-read and verify that the first IDAW address is unchanged between the initial size-calculation read and the subsequent full IDAL processing. Patched commits are available at Kernel Git Commit 08ef2a8, Kernel Git Commit 0d46c25, Kernel Git Commit 460b977, Kernel Git Commit 565bef2, and Kernel Git Commit fc59e94.
Workarounds
- Unload the vfio_ccw kernel module on hosts that do not require channel device pass-through
- Remove vfio_ccw device assignments from untrusted guests until the host kernel is patched
- Where feasible, migrate affected guest workloads to already-patched hosts
# Verify installed kernel version and vfio_ccw module status
uname -r
lsmod | grep vfio_ccw
# Temporarily unload vfio_ccw where not required
modprobe -r vfio_ccw
# Prevent module autoload until patched
echo 'blacklist vfio_ccw' | sudo tee /etc/modprobe.d/disable-vfio-ccw.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
