CVE-2026-80549

A flaw was found in the Linux kernel's s390/vfio_ccw component. When a device is lost, the fsm_notoper() routine performs cleanup while potentially holding other locks, such as the cio subchannel lock. This improper handling of resource cleanup in an asynchronous context could lead to a deadlock, causing system instability or a denial of service (DoS).

A LOW impact flaw was found in the Linux kernel s390/vfio_ccw driver. When a host channel device that is passed through to a guest via a vfio_ccw mediated device is lost, the fsm_notoper() routine can run asynchronously and free channel-program resources while other locks, notably the cio subchannel lock, are held in the calling sequence. This improper lock context during cleanup can lead to a deadlock in the host kernel, resulting in a denial of service. Exploitation requires local access to an s390 system configured with vfio_ccw device pass-through and depends on an asynchronous device-loss event, which limits practical exploitability. Red Hat Enterprise Linux 6, 7, and 8 are marked not affected because the vulnerable code is not present in those releases, while the affected RHEL 9, RHEL 10, and Red Hat In-Vehicle OS 2 streams have the fix deferred to a future update. The residual risk of the deferred fix is limited to availability of the host, with no impact on confidentiality or integrity. Red Hat's severity differs from the upstream CVE record, which scores this issue as 8.2 IMPORTANT by assuming changed scope with high confidentiality and integrity impact; Red Hat instead assesses this as a local availability-only denial of service (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and rates the overall impact as LOW.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.