CVE-2026-80555

s390/vfio_ccw: Free all memory if cp_init() fails

State: Published
Severity: 7.1 High
Published: Aug 26, 2026
Updated: Aug 27, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Free all memory if cp_init() fails

The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory.

An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program.

Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 276bd7ed34d56c48c65c43c0b08f2ee77029b2faAffected 8b515be512a2435bb8aedc6390cbe140167f9eb9 to before f9bcff265556796834122f95de16d52a8375206cAffected 8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 17e01e342af74de12899c206dcc9ec90684703aaAffected 8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 152fcb74a26804b70909381c6acc90595a0ae1c1Affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 6a917199aaf97904f5619afe3dfdacb155b03e8cAffected 8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 32e3d364a7b8295120d37e6a6bd433d2de26f748Affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 4699b54fada156534cbb39834d47fc9374d7a1f5Affected 8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 74186c2968f8f756ac3226b545b598457c910c75Affected
LinuxLinux	5.3Affected before 5.3Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.154 through 6.6.Not affected 6.12.105 through 6.12.Not affected 6.18.46 through 6.18.Not affected 7.1.10 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 276bd7ed34d56c48c65c43c0b08f2ee77029b2faAffected
8b515be512a2435bb8aedc6390cbe140167f9eb9 to before f9bcff265556796834122f95de16d52a8375206cAffected
8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 17e01e342af74de12899c206dcc9ec90684703aaAffected
8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 152fcb74a26804b70909381c6acc90595a0ae1c1Affected
8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 6a917199aaf97904f5619afe3dfdacb155b03e8cAffected
8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 32e3d364a7b8295120d37e6a6bd433d2de26f748Affected
8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 4699b54fada156534cbb39834d47fc9374d7a1f5Affected
8b515be512a2435bb8aedc6390cbe140167f9eb9 to before 74186c2968f8f756ac3226b545b598457c910c75Affected

LinuxLinux

5.3Affected
before 5.3Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.154 through 6.6.*Not affected
6.12.105 through 6.12.*Not affected
6.18.46 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.