CVE-2026-80553: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80553 Overview

CVE-2026-80553 is a Linux kernel vulnerability in the s390/vfio_ccw subsystem. The flaw resides in the driver's device release path, where the io_work and crw_work workqueues are initialized but never cancelled before the private structure is freed. This creates a use-after-free condition when queued work executes after the backing memory has been released. The vulnerability affects IBM Z (s390) systems using VFIO-based channel I/O passthrough, commonly deployed for virtualization of mainframe workloads.

Critical Impact
A local, authenticated user with access to the vfio_ccw device can trigger memory corruption in kernel context, leading to privilege escalation, information disclosure, or system compromise across VM boundaries.

Affected Products

Linux kernel with s390/vfio_ccw driver enabled
IBM Z / LinuxONE (s390x architecture) hosts using VFIO channel I/O passthrough
Virtualization stacks relying on vfio_ccw for guest CCW device assignment

Discovery Timeline

2026-08-26 - CVE-2026-80553 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80553

Vulnerability Analysis

The s390/vfio_ccw driver mediates channel I/O for guest virtual machines on IBM Z. During device initialization, two workqueues, io_work and crw_work, are set up to process asynchronous I/O completion and channel-report-word events. According to the upstream commit message, no matching cleanup was performed when the device was released.

When _release_dev runs, the private state structure backing the vfio_ccw device is freed. If either workqueue still has pending or in-flight work items, the worker thread will dereference freed memory. This is a classic use-after-free pattern arising from missing lifecycle management of asynchronous kernel workers.

The fix adds cancel_work_sync() calls for both workqueues in the release path, ensuring no worker can run after the private struct is destroyed.

Root Cause

The root cause is incomplete resource teardown. The driver initialized deferred work handlers without symmetric cancellation. Because workqueues can hold pointers to the private device structure, freeing that structure while work remains queued produces a dangling reference dereferenced in soft-IRQ or worker context.

Attack Vector

Exploitation requires local access with permission to interact with an assigned vfio_ccw device, typically a VM host administrator or a workload with /dev/vfio access. An attacker can race device release against pending I/O to trigger the freed-memory access. Because the scope is Changed, successful exploitation can affect components outside the driver's original security context, including the host kernel serving other guests.

No public proof-of-concept has been published. The vulnerability was resolved through the Linux stable tree with multiple backport commits, indicating impact across several maintained kernel branches.

Detection Methods for CVE-2026-80553

Indicators of Compromise

Kernel oops or panic messages referencing vfio_ccw, io_work, or crw_work in dmesg or /var/log/messages
KASAN use-after-free reports naming vfio_ccw_private or related structures on s390x hosts
Unexpected termination or hang of guest VMs using passthrough CCW devices

Detection Strategies

Inventory s390x hosts running kernels predating the fix commits (7492ca2d0c5d, 77f5e888d2e6, 79c60b2c6110, 87d569cb35a5, b7ae0f799386, b94b28c1f0fa, dc47a98abe67, e868ea8be0bc)
Correlate kernel crash telemetry from IBM Z hosts with VM lifecycle events, particularly device detach or guest shutdown
Audit which users and services hold /dev/vfio/* capabilities on affected hosts

Monitoring Recommendations

Forward kernel logs from s390x hypervisor hosts to a centralized data lake and alert on vfio_ccw fault signatures
Track VFIO device attach and release syscalls per workload to establish a baseline
Enable KASAN or kernel lockdown on non-production s390x systems to surface latent use-after-free conditions during testing

How to Mitigate CVE-2026-80553

Immediate Actions Required

Update affected s390x kernels to a stable release containing the fix commits listed in the upstream references
Restrict access to /dev/vfio and CCW passthrough capabilities to trusted administrators and service accounts only
Audit VM configurations to identify guests using vfio_ccw passthrough and schedule maintenance windows for host patching

Patch Information

The fix is available in the Linux stable tree across multiple maintained branches. Apply the vendor-provided kernel update for your distribution. Reference the upstream commits: 7492ca2d0c5d, 77f5e888d2e6, 79c60b2c6110, 87d569cb35a5, b7ae0f799386, b94b28c1f0fa, dc47a98abe67, and e868ea8be0bc.

Workarounds

Where patching is not immediately possible, disable the vfio_ccw module on hosts that do not require CCW passthrough by blacklisting it in /etc/modprobe.d/
Migrate guests off affected hosts and reduce the population of privileged users with VFIO access until kernel updates are applied
Enforce mandatory access control policies (SELinux or AppArmor) that constrain which processes may open VFIO device nodes

bash

# Blacklist vfio_ccw where passthrough is not required
echo 'blacklist vfio_ccw' | sudo tee /etc/modprobe.d/blacklist-vfio-ccw.conf
sudo depmod -a
# Verify current kernel version against fix commits
uname -r