CVE-2026-80548

A flaw was found in the Linux kernel's s390/vfio_ccw component. The io_mutex was not sufficiently expanded to serialize I/O operations, which could lead to race conditions. These race conditions could result in unexpected system behavior or instability.

A moderate impact flaw was found in the Linux kernel's s390/vfio_ccw driver, affecting Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2. The io_mutex was not consistently held across the channel-program and I/O lifecycle paths, so operations such as I/O completion, device close, not-operational cleanup, or CRW handling could race against channel-program teardown. A local attacker with access to a vfio_ccw (VFIO-CCW mediated) device on an IBM s390x system could exploit this race to cause use-after-free or list corruption in kernel I/O structures, resulting at minimum in a kernel crash and denial of service. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 streams the fix has been deferred: reliably triggering this timing-dependent race requires local access to a vfio_ccw passthrough device and the practical impact is denial of service, so the fix will be delivered in a future scheduled kernel update rather than an immediate erratum. The residual risk is a local kernel panic on s390x systems that use vfio_ccw device passthrough. Red Hat has rated this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE.org rating of Important (8.8) because exploitation requires local access and privileges on a system configured with vfio_ccw devices and Red Hat's assessment limits the impact to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can only be triggered through the vfio_ccw driver on IBM s390x systems. As a mitigation, avoid using vfio-ccw passthrough: do not create or assign vfio_ccw mediated devices to guests or untrusted local processes, and restrict local access to vfio_ccw devices, until a kernel containing the fix is applied. Systems that do not use vfio-ccw mediated devices are not exposed to this flaw.