CVE-2026-80555s390/vfio_ccw: Free all memory if cp_init() fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 276bd7ed34d56c48c65c43c0b08f2ee77029b2fa; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before f9bcff265556796834122f95de16d52a8375206c; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 17e01e342af74de12899c206dcc9ec90684703aa; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 152fcb74a26804b70909381c6acc90595a0ae1c1; 8b515be512a2435bb8aedc6390cbe140167f9eb9 builds before 6a917199aaf97904f5619afe3dfdacb155b03e8c; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 32e3d364a7b8295120d37e6a6bd433d2de26f748; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 4699b54fada156534cbb39834d47fc9374d7a1f5; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 74186c2968f8f756ac3226b545b598457c910c75 | CNA record |
References
- https://git.kernel.org/stable/c/276bd7ed34d56c48c65c43c0b08f2ee77029b2fa
- https://git.kernel.org/stable/c/f9bcff265556796834122f95de16d52a8375206c
- https://git.kernel.org/stable/c/17e01e342af74de12899c206dcc9ec90684703aa
- https://git.kernel.org/stable/c/152fcb74a26804b70909381c6acc90595a0ae1c1
- https://git.kernel.org/stable/c/6a917199aaf97904f5619afe3dfdacb155b03e8c
- https://git.kernel.org/stable/c/32e3d364a7b8295120d37e6a6bd433d2de26f748
- https://git.kernel.org/stable/c/4699b54fada156534cbb39834d47fc9374d7a1f5
- https://git.kernel.org/stable/c/74186c2968f8f756ac3226b545b598457c910c75
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.