CVE-2026-80550

A flaw was found in the s390/vfio_ccw component of the Linux kernel. The ccwchain_calc_length() routine, which counts channel command words (CCWs), incorrectly checked array boundaries. This could lead to an out-of-bounds read, where the system attempts to access memory beyond its allocated limits. Such an issue could potentially cause system instability or lead to the disclosure of sensitive information.

A moderate out-of-bounds read flaw was found in the s390 vfio_ccw driver of the Linux kernel as shipped in Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS. The ccwchain_calc_length() routine counts the channel command words (CCWs) chained in a channel program submitted through a vfio-ccw mediated device and rejects programs longer than 256 CCWs, but its loop condition allowed a possible 257th CCW to be examined before the program was rejected, reading one element beyond the allocated CCW array. Exploiting this requires local, privileged access in a context that can submit channel programs to a vfio-ccw device on s390 hardware, for example a guest with such a device assigned; the flaw is not network-reachable. The main consequence assessed by Red Hat is an impact to system availability (kernel instability), with at most a theoretical disclosure of adjacent memory. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. For the affected releases the fix is deferred: the issue is a single-element out-of-bounds read restricted to specific s390 vfio-ccw configurations and rated moderate, so the residual risk is limited to s390 deployments that expose vfio-ccw mediated devices to privileged local users or guests until a fix is delivered. Red Hat rates this flaw MODERATE (CVSS 5.5, availability impact only), which differs from the upstream CVEORG rating of 7.9/IMPORTANT because the upstream score credits high confidentiality impact, whereas Red Hat's assessment finds the realistic impact to be availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.