CVE-2026-80550s390/vfio_ccw: Fix out of bounds check on CCW array
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
- CVSS
- 7.9 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before 0282fb1c4b638eecfe2cc558092c460911d8f7e2; from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before 907adc667d902fafbdb2d740d57b55bd025dc4cd; from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before f20be33d093ce7630c17ff7ed93caf7eaf8ac1a3; from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before af3f80ca4c8b17f20f9e588def076288fdb49e65; from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before 499a8a66b1598bfab97182aed15e0f1646074a3d; from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before 4c2e1d359d7a2b82cdf3254e4e480af9417f99fb; from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before d5d096cd9369e986d4e5153baa86b8b35c283e09; from 0a19e61e6d4c6192077ead760ba0a2d350987d4c before a005b7f1a491ffda61bff0fd0f6548f8986fb977 | CNA record |
References
- https://git.kernel.org/stable/c/0282fb1c4b638eecfe2cc558092c460911d8f7e2
- https://git.kernel.org/stable/c/907adc667d902fafbdb2d740d57b55bd025dc4cd
- https://git.kernel.org/stable/c/f20be33d093ce7630c17ff7ed93caf7eaf8ac1a3
- https://git.kernel.org/stable/c/af3f80ca4c8b17f20f9e588def076288fdb49e65
- https://git.kernel.org/stable/c/499a8a66b1598bfab97182aed15e0f1646074a3d
- https://git.kernel.org/stable/c/4c2e1d359d7a2b82cdf3254e4e480af9417f99fb
- https://git.kernel.org/stable/c/d5d096cd9369e986d4e5153baa86b8b35c283e09
- https://git.kernel.org/stable/c/a005b7f1a491ffda61bff0fd0f6548f8986fb977
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.