CVE-2026-80548s390/vfio_ccw: Selectively expand io_mutex
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_regions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of races that are possible, the choices are either to: A) expand the scope of io_mutex to close these remaining windows, or B) reduce the scope of io_mutex to just io_region, and introduce a new lock mechanism for the remaining I/O resources This patch implements A, since B brings with it a lot more interactions that would need to be tracked and kept in a correct hierarchy. It also takes advantage of the workqueue element for cp_free() that now gets called out of fsm_notoper(), which could be invoked out of an interrupt context and thus cannot acquire a mutex itself.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4f76617378ee97c557b526cb58d3c61eb0a9c963 before dab6a6627b0b0cce23653e99c7b0bf8c6cfd82e0; from 4f76617378ee97c557b526cb58d3c61eb0a9c963 before 56d7488533ceac4e986e96e15c9e487a2245bc01; from 4f76617378ee97c557b526cb58d3c61eb0a9c963 before f72a51810d49411bd8cad0c2df8592320a2fe5cc; 4f76617378ee97c557b526cb58d3c61eb0a9c963 builds before 2ba9efdf9ebedc4e54df4b56aa3b43a65f7967cd; from 4f76617378ee97c557b526cb58d3c61eb0a9c963 before b6aecea4b2b246f9fbd98a5712daa1193a60818e; 4f76617378ee97c557b526cb58d3c61eb0a9c963 builds before 2a5ac0c0f1f7da33929211a2e41911bf72ee35d8; from 4f76617378ee97c557b526cb58d3c61eb0a9c963 before 34f4feff3e90bd09308fad0974e97113b23b812a | CNA record |
References
- https://git.kernel.org/stable/c/dab6a6627b0b0cce23653e99c7b0bf8c6cfd82e0
- https://git.kernel.org/stable/c/56d7488533ceac4e986e96e15c9e487a2245bc01
- https://git.kernel.org/stable/c/f72a51810d49411bd8cad0c2df8592320a2fe5cc
- https://git.kernel.org/stable/c/2ba9efdf9ebedc4e54df4b56aa3b43a65f7967cd
- https://git.kernel.org/stable/c/b6aecea4b2b246f9fbd98a5712daa1193a60818e
- https://git.kernel.org/stable/c/2a5ac0c0f1f7da33929211a2e41911bf72ee35d8
- https://git.kernel.org/stable/c/34f4feff3e90bd09308fad0974e97113b23b812a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.