CVE-2026-80552 Overview
CVE-2026-80552 is a Linux kernel vulnerability in the s390 vfio_ccw subsystem. The flaw allows a local, authenticated attacker to supply out-of-range region indexes to read and write operations because bounds enforcement was applied only to capability chain regions. The vfio_ccw driver failed to clamp region indexes for the existing read/write regions, enabling access outside the intended region array. The issue affects s390 (IBM Z) systems using vfio_ccw for channel I/O device passthrough to virtual machines.
Critical Impact
A local low-privileged user with access to a vfio_ccw device can trigger out-of-bounds region access, leading to confidentiality, integrity, and availability impact with a scope change across the virtualization boundary.
Affected Products
- Linux kernel s390 architecture builds with CONFIG_VFIO_CCW enabled
- Multiple stable kernel branches prior to the fix commits referenced in the kernel.org advisory
- IBM Z / LinuxONE hypervisor hosts using channel I/O device passthrough
Discovery Timeline
- 2026-08-26 - CVE-2026-80552 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80552
Vulnerability Analysis
The vfio_ccw driver exposes s390 channel I/O subchannels to userspace via the VFIO framework, allowing virtual machines to directly access channel devices. VFIO devices publish a set of regions that userspace can read from or write to using region indexes.
When the capability chain feature was added, developers correctly clamped region indexes to the size of the capability chain. The pre-existing read and write region handlers, however, did not receive the same bounds enforcement. As a result, a local user with access to the vfio_ccw character device can pass an index that falls outside the valid region array during read or write operations.
Because vfio_ccw bridges guest-controlled I/O into host kernel structures, the vulnerability crosses a security scope. An attacker inside a guest or a local user with device access can influence host kernel memory paths.
Root Cause
The root cause is a missing input validation check [CWE-129: Improper Validation of Array Index] on region indexes passed to the vfio_ccw read and write file operations. The capability chain refactor introduced index clamping for capability regions but did not extend that check to the legacy read/write region dispatch.
Attack Vector
Exploitation requires local access and low privileges on a host running an affected kernel with vfio_ccw bound to a subchannel accessible to the attacker. The attacker opens the vfio_ccw device file and issues read() or write() syscalls that reference a region index outside the valid range. This triggers out-of-bounds region descriptor access inside the kernel, which can be used for information disclosure, memory corruption, or denial of service.
No public proof-of-concept exploit is currently available. Refer to the kernel.org stable commit 3acbedf and related fix commits for the exact code paths that were corrected.
Detection Methods for CVE-2026-80552
Indicators of Compromise
- Unexpected kernel oops, WARN_ON, or BUG messages referencing vfio_ccw region handlers in dmesg or /var/log/messages
- Non-root or guest-owning processes opening /dev/vfio/* nodes that map to s390 subchannels outside of expected virtualization workflows
- Anomalous read() and write() syscalls against vfio_ccw device files with unusual offset patterns indicating region index manipulation
Detection Strategies
- Audit kernel version and CONFIG_VFIO_CCW status on all s390 hosts and compare against fixed commit hashes referenced by the kernel.org advisory
- Enable auditd rules on /dev/vfio/ to record open, read, and write events, then baseline expected users and container/QEMU processes
- Monitor kernel log ingestion pipelines for panics or stack traces implicating vfio_ccw_mdev_read or vfio_ccw_mdev_write code paths
Monitoring Recommendations
- Forward /var/log/kern.log and dmesg output to a centralized logging platform and alert on vfio_ccw faults
- Track process lineage for any workload that opens VFIO device nodes and correlate with authorized hypervisor management accounts
- Review KVM/QEMU guest configurations for vfio-ccw passthrough usage and inventory all guests with access to affected subchannels
How to Mitigate CVE-2026-80552
Immediate Actions Required
- Update affected s390 Linux kernels to a version containing the fix commits published on kernel.org
- Inventory all IBM Z hosts using vfio_ccw passthrough and prioritize patching hosts with untrusted guests or multi-tenant workloads
- Restrict access to /dev/vfio/* device nodes to trusted virtualization service accounts only
Patch Information
The Linux kernel maintainers released fixes across multiple stable branches. The relevant stable commits are 3acbedf, 649badf, 79ea5e0, 988d9b5, 9f5f9a7, d3b1e38, and d597fa1. Apply the distribution-provided kernel package containing the corresponding backport as soon as it is available.
Workarounds
- Unbind untrusted subchannels from vfio_ccw and reassign them to the standard io_subchannel driver until patched kernels are deployed
- Remove vfio-ccw device passthrough from guest domain XML for untrusted or multi-tenant VMs and use virtualized channel I/O instead
- Tighten file permissions and Linux capabilities on /dev/vfio/* so that only vetted hypervisor management processes can open the devices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
