CVE-2026-80550

What it actually does

An off-by-one bounds check in the Linux kernel s390 vfio_ccw path (ccwchain_calc_length) lets the kernel inspect one channel command word past a 256-element CCW array when measuring a chained channel program. The result is an out-of-bounds kernel read. Because vfio_ccw sits on the KVM I/O-passthrough boundary, the read can cross from guest or unprivileged local context into host kernel memory (changed scope): high confidentiality impact, no integrity impact, and limited availability impact if the invalid access faults.

Why it matters to the business

This matters mainly to IBM Z (s390) Linux virtualization hosts that assign channel-attached devices to guests via VFIO-CCW. A successful trigger can leak host or kernel memory to a local user or guest and may cause a limited host-side disruption, weakening hypervisor isolation. It is not in CISA KEV, has no known ransomware use, and exploit maturity is none; EPSS remains low (~0.18%) though it rose about 32% over 30 days. With a 7.9 CVSS and changed-scope rating, kernel updates on s390 KVM hosts are still warranted even though general-purpose x86 estates are unaffected. No downstream package prevalence or exact fixed versions were supplied.

How an attack unfolds

An attacker with local code execution on an s390 Linux system, or control of a KVM guest that has a VFIO-CCW device assigned, submits a channel program whose CCW chain is sized to hit the maximum allowed length. The unpatched loop examines a 257th CCW before rejecting the program, reading adjacent kernel memory. Any data returned or observed across the VFIO isolation boundary can disclose privileged host state. No public exploit, named threat actor, or campaign is associated with this issue.

How to fix it

Apply the upstream Linux kernel fix that stops ccwchain_calc_length() after 256 CCWs (indexes 0–255) and does not inspect memory outside that range. Upgrade s390 kernels to a vendor/distribution build that includes this vfio_ccw change; exact package versions were not provided, so follow your distro advisory and changelog. If CCW passthrough is not required, do not assign CCW devices to guests and keep the vfio_ccw module unloaded. Restrict who can run guests with VFIO-CCW assignment until patched.

How to confirm the fix worked

Confirm the running s390 kernel changelog or vendor advisory lists the vfio_ccw CCW-array bounds fix. On hosts that should not use passthrough, verify vfio_ccw is not loaded and that no guests have CCW devices assigned. After patching, regression-test legitimate VFIO-CCW channel programs and confirm over-length programs are rejected without kernel faults or oopses.

Typical attack path

1. Obtain local execution on an s390 Linux host or on a KVM guest with VFIO-CCW device assignment
2. Submit a channel program that chains CCWs up to the documented maximum length
3. Cause the kernel length-check path to read one CCW past the allocated array
4. Observe disclosed host or kernel memory and/or a limited host-side fault
5. Use any leaked host data to plan further attacks against the hypervisor or co-located workloads

How to detect it

There is no public exploit, named actor, or ransomware campaign, so look for residual crash evidence rather than a known payload. On s390 KVM hosts, review kernel logs around vfio_ccw and CCW-chain handling for oopses, page faults, or unexpected warnings in the length-check path; correlate with guests that have CCW devices assigned and with unusual I/O-passthrough errors. Forensic memory or vmcore analysis after a vfio_ccw-related fault is more useful than network IOCs. Absence of such artifacts does not prove the bug was never triggered, because a pure out-of-bounds read may leave little trace.

What your security team should do

• Patch s390 Linux KVM/virtualization hosts first; this is a changed-scope kernel OOB read on the VFIO-CCW path
• Inventory guests and hosts that load vfio_ccw or assign channel devices; disable unused passthrough
• Until patched, limit who can create or run guests with VFIO-CCW assignment
• Track distro kernel advisories for the exact fixed build; no KEV deadline or named in-the-wild activity currently drives emergency change windows
• Reassess after patching: no public exploit or ransomware use is known, but EPSS has ticked up and isolation-boundary bugs remain high priority on shared mainframe hosts