CVE-2026-80547

A flaw was found in the Linux kernel's s390/vfio_ccw component. This vulnerability arises from the lack of a proper lock to manage the list of Channel Report Word (CRW) payloads, which are asynchronous events from hardware. Without this lock, these payloads may not be read cohesively, potentially leading to data inconsistency or unexpected system behavior.

A MODERATE severity flaw was found in the Linux kernel's s390/vfio_ccw driver. The list of Channel Report Word (CRW) payloads, which is populated exclusively by asynchronous events from hardware, was managed without a dedicated lock. Concurrent access to this list from the asynchronous hardware-event path and userspace read or device-release paths can race, corrupting the CRW payload list and leading to data inconsistency or a host kernel crash on s390 systems that use vfio_ccw mediated channel devices. Red Hat rates this flaw MODERATE with CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): exploitation requires local access and privileges on an s390 system using a vfio_ccw mediated device, and the direct impact is denial of service; no confidentiality or integrity impact has been established. This differs from the upstream CVEORG rating of 8.8 (IMPORTANT), which assumes scope change with high confidentiality and integrity impacts that the available evidence does not support. Per the current assessment, the affected Red Hat offerings are the RHEL 9 and RHEL 10 kernel and kernel-rt components and the Red Hat In-Vehicle OS 2.0/2.1 kernel and kernel-ivos-qualcomm components, while the RHEL 6, 7, and 8 kernel and kernel-rt streams are marked not affected because the vulnerable code is not present in those streams. For the affected streams the fix is deferred to a future maintenance update given the MODERATE, availability-only nature of the issue; the residual risk is that a local privileged user on an affected s390 system using vfio_ccw could trigger kernel memory corruption resulting in a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.