GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80547 (GCVE-0-2026-80547)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 12:40
VLAI
Title
s390/vfio_ccw: Implement a crw lock
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3f02cb2fd9d2d9e8762102886e3e4b51285797ee , < 3c94d4179bcc19e01b28db634c07a58b28116209 (git)
Affected: 3f02cb2fd9d2d9e8762102886e3e4b51285797ee , < 0edd222730a9d7ec98368aaf1d40ee2d8d862e61 (git)
Affected: 3f02cb2fd9d2d9e8762102886e3e4b51285797ee , < a3d60ae24183eee352c8e87a0ff94c97cd87f156 (git)
Affected: 3f02cb2fd9d2d9e8762102886e3e4b51285797ee , < 49fa26b0df009dc1f420980bd71780e70615b83b (git)
Affected: 3f02cb2fd9d2d9e8762102886e3e4b51285797ee , < 7902be374cbfc11c3435e1e87bf22195bf06a558 (git)
Affected: 3f02cb2fd9d2d9e8762102886e3e4b51285797ee , < c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9 (git)
Affected: 3f02cb2fd9d2d9e8762102886e3e4b51285797ee , < 16b0798024c0e9117e395829ddbbe70981c79d9c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.15.218 , ≤ 5.15.* (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.154 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_chp.c",
            "drivers/s390/cio/vfio_ccw_drv.c",
            "drivers/s390/cio/vfio_ccw_ops.c",
            "drivers/s390/cio/vfio_ccw_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c94d4179bcc19e01b28db634c07a58b28116209",
              "status": "affected",
              "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee",
              "versionType": "git"
            },
            {
              "lessThan": "0edd222730a9d7ec98368aaf1d40ee2d8d862e61",
              "status": "affected",
              "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee",
              "versionType": "git"
            },
            {
              "lessThan": "a3d60ae24183eee352c8e87a0ff94c97cd87f156",
              "status": "affected",
              "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee",
              "versionType": "git"
            },
            {
              "lessThan": "49fa26b0df009dc1f420980bd71780e70615b83b",
              "status": "affected",
              "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee",
              "versionType": "git"
            },
            {
              "lessThan": "7902be374cbfc11c3435e1e87bf22195bf06a558",
              "status": "affected",
              "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee",
              "versionType": "git"
            },
            {
              "lessThan": "c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9",
              "status": "affected",
              "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee",
              "versionType": "git"
            },
            {
              "lessThan": "16b0798024c0e9117e395829ddbbe70981c79d9c",
              "status": "affected",
              "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_chp.c",
            "drivers/s390/cio/vfio_ccw_drv.c",
            "drivers/s390/cio/vfio_ccw_ops.c",
            "drivers/s390/cio/vfio_ccw_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Implement a crw lock\n\nUnlike the channel_program struct, which covers synchronous I/O\nsubmissions and asynchronous interrupts, the CRW region relies\nexclusively on asynchronous events coming from hardware.\n\nImplement a lock to manage the list of those payloads, to ensure\nthey are read cohesively."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only via local VFIO mediated-device access (read/ioctl on /dev/vfio/* device fds) to the CCW CRW region; vfio-ccw has no network, Bluetooth, or physical-bus packet entry point.\nAC:L - The attacker controls CRW region reads and can retry concurrently while channel-path events queue CRWs via vfio_ccw_chp_event(); this user-versus-hardware/workqueue list race is winnable without conditions outside attacker influence.\nPR:L - Triggering requires an opened vfio-ccw mdev fd (typical QEMU/libvirt VM operator or delegated /dev/vfio holder on IBM Z passthrough hosts), not init-namespace root; admin creates the mdev but exploitation needs only that VFIO client access.\nUI:N - No separate victim action is required; once vfio-ccw passthrough is configured, the attacker repeatedly reads the CRW region while guest/channel I/O generates asynchronous path events without needing another user to interact.\nS:C - On IBM Z/LinuxONE, vfio-ccw passes DASD subchannels into KVM guests; guest-driven channel activity causes host-side CRW queuing while the VFIO client reads the CRW region, corrupting hypervisor kernel memory outside the VM security boundary.\nC:H - Unsynchronized list_del/list_add/kfree on kmalloc vfio_ccw_crw objects is a use-after-free/list-corruption primitive; per kernel guidance this enables attacker-influenced heap reuse and arbitrary kernel memory disclosure.\nI:H - Corrupted list pointers and freed CRW entries allow heap-sprayable arbitrary writes and control-flow hijack beyond a simple crash, matching kernel guidance for use-after-free and memory corruption bugs.\nA:H - Concurrent unsynchronized list manipulation can immediately oops or panic the host kernel via invalid list operations or double-free, and successful exploitation can hang or crash the entire system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:07.162Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c94d4179bcc19e01b28db634c07a58b28116209"
        },
        {
          "url": "https://git.kernel.org/stable/c/0edd222730a9d7ec98368aaf1d40ee2d8d862e61"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3d60ae24183eee352c8e87a0ff94c97cd87f156"
        },
        {
          "url": "https://git.kernel.org/stable/c/49fa26b0df009dc1f420980bd71780e70615b83b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7902be374cbfc11c3435e1e87bf22195bf06a558"
        },
        {
          "url": "https://git.kernel.org/stable/c/c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/16b0798024c0e9117e395829ddbbe70981c79d9c"
        }
      ],
      "title": "s390/vfio_ccw: Implement a crw lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80547",
    "datePublished": "2026-08-26T14:37:18.159Z",
    "dateReserved": "2026-08-26T14:34:25.766Z",
    "dateUpdated": "2026-08-27T12:40:07.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80547",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.02911"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:05:12.000Z",
      "cve": "CVE-2026-80547",
      "id": "msrc_CVE-2026-80547",
      "initial_release_date": "2026-08-27T01:05:12.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "s390/vfio_ccw: Implement a crw lock",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80547.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80547\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:09.087\",\"lastModified\":\"2026-08-27T13:18:39.240\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/vfio_ccw: Implement a crw lock\\n\\nUnlike the channel_program struct, which covers synchronous I/O\\nsubmissions and asynchronous interrupts, the CRW region relies\\nexclusively on asynchronous events coming from hardware.\\n\\nImplement a lock to manage the list of those payloads, to ensure\\nthey are read cohesively.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/s390/cio/vfio_ccw_chp.c\",\"drivers/s390/cio/vfio_ccw_drv.c\",\"drivers/s390/cio/vfio_ccw_ops.c\",\"drivers/s390/cio/vfio_ccw_private.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3f02cb2fd9d2d9e8762102886e3e4b51285797ee\",\"lessThan\":\"3c94d4179bcc19e01b28db634c07a58b28116209\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f02cb2fd9d2d9e8762102886e3e4b51285797ee\",\"lessThan\":\"0edd222730a9d7ec98368aaf1d40ee2d8d862e61\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f02cb2fd9d2d9e8762102886e3e4b51285797ee\",\"lessThan\":\"a3d60ae24183eee352c8e87a0ff94c97cd87f156\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f02cb2fd9d2d9e8762102886e3e4b51285797ee\",\"lessThan\":\"49fa26b0df009dc1f420980bd71780e70615b83b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f02cb2fd9d2d9e8762102886e3e4b51285797ee\",\"lessThan\":\"7902be374cbfc11c3435e1e87bf22195bf06a558\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f02cb2fd9d2d9e8762102886e3e4b51285797ee\",\"lessThan\":\"c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f02cb2fd9d2d9e8762102886e3e4b51285797ee\",\"lessThan\":\"16b0798024c0e9117e395829ddbbe70981c79d9c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/s390/cio/vfio_ccw_chp.c\",\"drivers/s390/cio/vfio_ccw_drv.c\",\"drivers/s390/cio/vfio_ccw_ops.c\",\"drivers/s390/cio/vfio_ccw_private.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.218\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.185\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.154\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0edd222730a9d7ec98368aaf1d40ee2d8d862e61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/16b0798024c0e9117e395829ddbbe70981c79d9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c94d4179bcc19e01b28db634c07a58b28116209\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/49fa26b0df009dc1f420980bd71780e70615b83b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7902be374cbfc11c3435e1e87bf22195bf06a558\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3d60ae24183eee352c8e87a0ff94c97cd87f156\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T06:34:25+00:00",
      "cve": "CVE-2026-80547",
      "id": "CVE-2026-80547",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: s390/vfio_ccw: Implement a crw lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80547.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:11:50Z",
      "cve": "CVE-2026-80547",
      "id": "CVE-2026-80547",
      "initial_release_date": "2026-08-27T00:12:10Z",
      "product_status:known_affected": "236",
      "product_status:known_not_affected": "117",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80547",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80547.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.