CVE-2026-80555 Overview
CVE-2026-80555 affects the Linux kernel's s390/vfio_ccw subsystem on IBM Z (s390) architectures. The vulnerability stems from incomplete memory cleanup when the cp_init() routine fails during channel program initialization. When initialization fails, the existing recovery path in ccwchain_handle_ccw() only frees the currently-processed CCW segment. Additional segments allocated through Transfer in Channel (TIC) operations remain allocated, producing a kernel memory leak. Local users with access to the vfio_ccw interface can trigger repeated failures to exhaust kernel memory and cause availability impact on the host.
Critical Impact
A local attacker can trigger repeated cp_init() failures through the vfio_ccw interface to exhaust kernel memory and cause a denial-of-service condition on s390 systems.
Affected Products
- Linux kernel on IBM Z (s390) architecture with CONFIG_VFIO_CCW enabled
- Systems exposing vfio_ccw mediated devices to userspace or virtual machines
- Distributions shipping affected mainline and stable kernel versions prior to the fix commits
Discovery Timeline
- 2026-08-26 - CVE-2026-80555 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80555
Vulnerability Analysis
The vfio_ccw driver enables passthrough of subchannels on s390 systems to userspace or virtual machines. During I/O setup, the driver builds an in-kernel representation of a channel program using cp_init(), which allocates and pins guest memory for one or more CCW chains. On successful completion or on cp_prefetch() failure, cp_free() releases the allocations. cp_free() relies on the cp->initialized flag, so it cannot be reused when cp_init() itself fails before that flag is set.
The pre-patch code attempts partial cleanup inside ccwchain_handle_ccw() by calling ccwchain_free() on the CCW segment currently being processed. Channel programs assembled via Transfer in Channel branch instructions can allocate multiple chained segments through the recursive ccwchain_handle_ccw() and ccwchain_loop_tic() paths. Segments allocated earlier in the recursion are never freed on error, leaking pinned pages and kernel structures.
Root Cause
The root cause is inconsistent ownership of allocated resources across a recursive allocation path. cp_init() builds a linked list of ccwchain structures, but its failure path releases only a single node instead of walking the full list. The fix moves cleanup out of the recursive helpers and performs it centrally in cp_init() after failure, ensuring every allocated chain, pinned page, and idal buffer is released.
Attack Vector
Exploitation requires local access to a system exposing vfio_ccw mediated devices. This typically means a user or guest VM with permission to open the mediated device file descriptor and submit channel programs. An attacker repeatedly submits malformed channel programs containing TIC instructions that cause cp_init() to fail after allocating multiple segments. Each failed attempt leaks kernel memory and pinned guest pages. The CVSS vector (AV:L/S:C/A:H) indicates local attack vector with scope change and high availability impact, consistent with a memory-exhaustion denial of service that crosses the guest-to-host boundary.
Detection Methods for CVE-2026-80555
Indicators of Compromise
- Steady growth of kernel slab allocations tied to vfio_ccw structures without corresponding release
- Elevated counts of pinned pages attributed to VFIO on s390 hosts
- Repeated vfio_ccw I/O submission failures originating from a single guest or user context
- Kernel log entries showing cp_init() or ccwchain allocation errors preceding memory pressure events
Detection Strategies
- Monitor /proc/slabinfo and /proc/meminfo on s390 hosts for unbounded growth in kernel allocations correlated with vfio_ccw usage
- Audit ioctl submissions to /dev/vfio/* from unprivileged contexts and alert on high error rates
- Correlate VM guest activity with host-side kernel memory pressure to identify a leaking workload
Monitoring Recommendations
- Track kernel version inventory across s390 fleets to identify hosts running unpatched builds
- Enable auditd rules covering vfio_ccw device access and mediated device configuration changes
- Baseline pinned-memory metrics per guest to detect abnormal accumulation
How to Mitigate CVE-2026-80555
Immediate Actions Required
- Apply the upstream kernel patches referenced below to all affected s390 hosts running vfio_ccw
- Restrict access to /dev/vfio/* and mediated CCW devices to trusted administrators and virtualization services only
- Audit which virtual machines and users are permitted to submit channel programs through vfio_ccw
Patch Information
The fix moves cleanup outside the recursive ccwchain_handle_ccw() and ccwchain_loop_tic() logic so that all allocated segments are released when cp_init() fails. The change has been backported across stable trees. Refer to the upstream commits: Kernel Git Commit 152fcb7, Kernel Git Commit 17e01e3, Kernel Git Commit 276bd7e, Kernel Git Commit 32e3d36, Kernel Git Commit 4699b54, Kernel Git Commit 6a91719, Kernel Git Commit 74186c2, and Kernel Git Commit f9bcff2.
Workarounds
- Disable the vfio_ccw kernel module on hosts that do not require CCW passthrough
- Remove or unassign mediated CCW devices from untrusted guests until patched kernels are deployed
- Apply memory cgroup limits to virtualization workloads to contain the blast radius of a leaking guest
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
