CVE-2026-80552

A flaw was found in the s390/vfio_ccw component of the Linux kernel. This vulnerability occurs because the system fails to properly validate index ranges for read/write operations on existing regions. This oversight could allow an attacker to perform out-of-bounds memory access, potentially leading to information disclosure or system instability.

s390 vfio_ccw did not fully enforce bounds checks for existing read and write region indexes. A local process with access to the vfio_ccw device interface could select an out of range region index and reach private region array access outside the valid num_regions range. This can cause invalid reads, invalid writes, NULL pointer dereference, or use of an unintended region ops pointer depending on adjacent memory layout. For the CVSS the PR:L is used in the paranoid score because reliable triggering requires local code execution with access to the VFIO device fd, but that access may be delegated to a reduced capability VM process or service account rather than full host root. The issue is not network reachable and is not directly triggered by packet traffic. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality and integrity impact due to out of bounds region access and possible memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.