CVE-2026-80553

s390/vfio_ccw: Cancel existing workqueues

State: Published
Severity: 8.8 High
Published: Aug 26, 2026
Updated: Oct 16, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Cancel existing workqueues

The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e5f84dbaea59b4f712dac428c337528b70e1c533 to before 87d569cb35a541b31a184faf982540694d4c9a89Affected e5f84dbaea59b4f712dac428c337528b70e1c533 to before 7492ca2d0c5d59add01e267be9f5a6eeb8076fd7Affected e5f84dbaea59b4f712dac428c337528b70e1c533 to before b94b28c1f0fae53b2f2d6180ae6442c9a1558f67Affected e5f84dbaea59b4f712dac428c337528b70e1c533 to before e868ea8be0bc88c6982f48ecf3259d98afd884aeAffected e5f84dbaea59b4f712dac428c337528b70e1c533 to before dc47a98abe6714577a25224534dbd356051097a3Affected e5f84dbaea59b4f712dac428c337528b70e1c533 to before b7ae0f7993867d009a4b554fc1d6d451c10580a0Affected e5f84dbaea59b4f712dac428c337528b70e1c533 to before 77f5e888d2e607a0b3141fb95091ad6ef1cca9a2Affected e5f84dbaea59b4f712dac428c337528b70e1c533 to before 79c60b2c61105368dcc8444eb45847e21734f7c4Affected
LinuxLinux	4.12Affected before 4.12Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.153 through 6.6.Not affected 6.12.105 through 6.12.Not affected 6.18.46 through 6.18.Not affected 7.1.10 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

e5f84dbaea59b4f712dac428c337528b70e1c533 to before 87d569cb35a541b31a184faf982540694d4c9a89Affected
e5f84dbaea59b4f712dac428c337528b70e1c533 to before 7492ca2d0c5d59add01e267be9f5a6eeb8076fd7Affected
e5f84dbaea59b4f712dac428c337528b70e1c533 to before b94b28c1f0fae53b2f2d6180ae6442c9a1558f67Affected
e5f84dbaea59b4f712dac428c337528b70e1c533 to before e868ea8be0bc88c6982f48ecf3259d98afd884aeAffected
e5f84dbaea59b4f712dac428c337528b70e1c533 to before dc47a98abe6714577a25224534dbd356051097a3Affected
e5f84dbaea59b4f712dac428c337528b70e1c533 to before b7ae0f7993867d009a4b554fc1d6d451c10580a0Affected
e5f84dbaea59b4f712dac428c337528b70e1c533 to before 77f5e888d2e607a0b3141fb95091ad6ef1cca9a2Affected
e5f84dbaea59b4f712dac428c337528b70e1c533 to before 79c60b2c61105368dcc8444eb45847e21734f7c4Affected

LinuxLinux

4.12Affected
before 4.12Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.153 through 6.6.*Not affected
6.12.105 through 6.12.*Not affected
6.18.46 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.