CVE-2026-80554

A flaw was found in the Linux kernel's s390/vfio_ccw component. The vfio-ccw logic processes channel programs recursively, breaking them into segments when a Transfer-In-Channel (TIC) Channel Command Word (CCW) is encountered. An attacker could exploit the lack of a proper limit on these segments, leading to excessive resource consumption. This could result in a denial of service, making the system unavailable.

A denial of service flaw was found in the Linux kernel s390 vfio_ccw driver, affecting Red Hat Enterprise Linux and Red Hat In-Vehicle OS with moderate impact. The vfio-ccw logic processes channel programs, and the Channel Command Words (CCWs) within them, recursively, and splits a channel program into segments whenever it encounters a Transfer-In-Channel (TIC) CCW. While an arbitrary limit exists on the number of CCWs in a channel program, the number of segments was not similarly limited. A local attacker with the ability to submit channel programs to a vfio-ccw passthrough device, for example from a guest on an s390 (IBM Z) host using vfio-ccw channel device passthrough, could supply a channel program that generates an excessive number of segments, driving uncontrolled recursive processing and excessive resource consumption, resulting in a denial of service that makes the system unavailable. Only s390 systems that use vfio-ccw device passthrough are exposed. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rather than the CVE.org Critical score of 9.3 because exploitation requires local access with the privilege to submit channel programs and the impact is limited to availability. Red Hat Enterprise Linux 6, 7, and 8 streams are not affected because the vulnerable code is not present in those releases. The fix for the affected Red Hat Enterprise Linux 9, 10, and Red Hat In-Vehicle OS streams is deferred to a future update; the upstream resolution imposes a limit on the number of channel program segments as an interim measure until the recursive processing logic can be made non-recursive. The residual risk of the deferral is a local denial of service by an attacker who can already submit channel programs to a vfio-ccw device on an affected s390 host.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.