CVE-2026-80550

s390/vfio_ccw: Fix out of bounds check on CCW array

State: Published
Severity: 7.9 High
Published: Aug 26, 2026
Updated: Oct 16, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Fix out of bounds check on CCW array

The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.

The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.

Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.

Scores

CVSS	Score	Vector	Source
3.1	7.9 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 0282fb1c4b638eecfe2cc558092c460911d8f7e2Affected 0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 907adc667d902fafbdb2d740d57b55bd025dc4cdAffected 0a19e61e6d4c6192077ead760ba0a2d350987d4c to before f20be33d093ce7630c17ff7ed93caf7eaf8ac1a3Affected 0a19e61e6d4c6192077ead760ba0a2d350987d4c to before af3f80ca4c8b17f20f9e588def076288fdb49e65Affected 0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 499a8a66b1598bfab97182aed15e0f1646074a3dAffected 0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 4c2e1d359d7a2b82cdf3254e4e480af9417f99fbAffected 0a19e61e6d4c6192077ead760ba0a2d350987d4c to before d5d096cd9369e986d4e5153baa86b8b35c283e09Affected 0a19e61e6d4c6192077ead760ba0a2d350987d4c to before a005b7f1a491ffda61bff0fd0f6548f8986fb977Affected
LinuxLinux	4.12Affected before 4.12Not affected 5.10.266 through 5.10.Not affected 5.15.217 through 5.15.Not affected 6.1.184 through 6.1.Not affected 6.6.153 through 6.6.Not affected 6.12.105 through 6.12.Not affected 6.18.46 through 6.18.Not affected 7.1.10 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 0282fb1c4b638eecfe2cc558092c460911d8f7e2Affected
0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 907adc667d902fafbdb2d740d57b55bd025dc4cdAffected
0a19e61e6d4c6192077ead760ba0a2d350987d4c to before f20be33d093ce7630c17ff7ed93caf7eaf8ac1a3Affected
0a19e61e6d4c6192077ead760ba0a2d350987d4c to before af3f80ca4c8b17f20f9e588def076288fdb49e65Affected
0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 499a8a66b1598bfab97182aed15e0f1646074a3dAffected
0a19e61e6d4c6192077ead760ba0a2d350987d4c to before 4c2e1d359d7a2b82cdf3254e4e480af9417f99fbAffected
0a19e61e6d4c6192077ead760ba0a2d350987d4c to before d5d096cd9369e986d4e5153baa86b8b35c283e09Affected
0a19e61e6d4c6192077ead760ba0a2d350987d4c to before a005b7f1a491ffda61bff0fd0f6548f8986fb977Affected

LinuxLinux

4.12Affected
before 4.12Not affected
5.10.266 through 5.10.*Not affected
5.15.217 through 5.15.*Not affected
6.1.184 through 6.1.*Not affected
6.6.153 through 6.6.*Not affected
6.12.105 through 6.12.*Not affected
6.18.46 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.