CVE-2026-80554 Overview
CVE-2026-80554 affects the Linux kernel's s390 vfio_ccw subsystem, which handles channel program processing for IBM Z (s390) mainframe virtualization. The vulnerability stems from recursive processing of Channel Command Words (CCWs) without an enforced limit on the number of channel program segments. When the vfio_ccw logic encounters a Transfer-In-Channel (TIC) CCW, it splits channel programs into segments processed recursively. An attacker with local access can craft channel programs that exhaust kernel stack resources through unbounded recursion.
Critical Impact
Local attackers can trigger unbounded recursion in the s390 vfio_ccw driver, leading to kernel stack exhaustion and full compromise of confidentiality, integrity, and availability across the changed scope.
Affected Products
- Linux kernel s390 architecture builds with vfio_ccw enabled
- IBM Z mainframe virtualization environments using pass-through channel I/O
- Distributions shipping affected kernel versions prior to the referenced stable patches
Discovery Timeline
- 2026-08-26 - CVE-2026-80554 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80554
Vulnerability Analysis
The vfio_ccw driver in the Linux kernel s390 architecture translates guest channel programs into host-executable I/O instructions. Channel programs consist of chained CCWs that describe I/O operations to subchannels. The driver's translation logic processes these programs recursively, particularly when handling Transfer-In-Channel (TIC) CCWs that branch execution to another CCW address.
Each TIC encountered causes vfio_ccw to split the channel program into a new segment and recursively descend into that segment. Without a hard limit on segment count, a malicious guest or local user with access to a mediated vfio_ccw device can craft channel programs containing large TIC chains. This forces the kernel into deep recursion, consuming kernel stack space and potentially corrupting adjacent kernel memory or crashing the host.
Root Cause
The root cause is missing bounds enforcement in the recursive CCW translation path. The existing arbitrary limit applied to individual CCWs within a channel program did not extend to the number of segments produced by TIC processing. The recursive design of the parser meant each segment consumed additional kernel stack frames without a corresponding depth ceiling.
Attack Vector
Exploitation requires local access to a system exposing a vfio_ccw mediated device, typically a KVM guest on an s390 host with pass-through subchannels. An attacker submits a specially constructed channel program containing chained TIC CCWs that reference additional CCW blocks. The kernel processes each TIC recursively, expanding the segment count until stack resources are exhausted. Because the scope is changed, successful exploitation can affect resources beyond the attacker's originally authorized security domain, including host kernel state.
No public exploit code is available. The upstream fix imposes an equivalent segment limit until the translation logic can be refactored to be non-recursive. See the kernel patch commits for the implementation.
Detection Methods for CVE-2026-80554
Indicators of Compromise
- Unexpected kernel oops or stack overflow messages referencing vfio_ccw translation functions in dmesg or /var/log/messages
- Host or guest instability originating from s390 subchannel I/O operations under vfio-ccw pass-through
- Kernel panics with call traces involving CCW chain processing and TIC handling
Detection Strategies
- Audit s390 hosts running vfio_ccw mediated device configurations and inventory kernel versions against the patched stable releases
- Monitor kernel logs for repeated warnings related to channel program translation failures or excessive segment counts
- Correlate guest workload behavior with host kernel stack usage anomalies on IBM Z systems
Monitoring Recommendations
- Enable kernel audit logging for vfio_ccw device access and mediated device attach/detach events
- Baseline normal CCW chain lengths for production workloads and alert on statistical outliers
- Track kernel crash dumps and forward them to a centralized analysis platform for review
How to Mitigate CVE-2026-80554
Immediate Actions Required
- Apply the upstream Linux kernel stable patches referenced in the NVD entry to all affected s390 hosts
- Restrict local access to systems exposing vfio_ccw mediated devices to trusted administrators and guest workloads
- Inventory IBM Z virtualization hosts and prioritize patching those exposing pass-through channel I/O to untrusted guests
Patch Information
The Linux kernel maintainers have released fixes across multiple stable branches. Reference commits include 06f4d6e, 15fb4559, 4ee94790, 5405c90d, and a1625f66. The patches impose a limit on the number of channel program segments equivalent to the existing per-CCW limit.
Workarounds
- Disable the vfio_ccw kernel module on hosts where mediated channel I/O pass-through is not required
- Remove or unbind vfio_ccw mediated devices from untrusted guest VMs until patches can be applied
- Limit guest CCW chain sizes through host-side policy where supported by the virtualization stack
# Verify kernel version and check whether vfio_ccw is loaded
uname -r
lsmod | grep vfio_ccw
# Temporarily unload the module if no pass-through workloads depend on it
sudo modprobe -r vfio_ccw
# Prevent automatic loading until patched kernel is deployed
echo "blacklist vfio_ccw" | sudo tee /etc/modprobe.d/vfio_ccw-cve-2026-80554.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
