CVE-2026-80549: s390/vfio_ccw: Move cp cleanup out of not operational
In the Linux kernel, the following vulnerability has been resolved:
s390/vfioccw: Move cp cleanup out of not operational
The fsmnotoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the cio subchannel lock).
Push the cleanup of the private->cp resources to a workqueue, where it can be done out from under that lock sequence and a future patch can safely manage the locking requirements.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The affected code is in the Linux kernel's s390 vfio_ccw component. Systems that do not use the s390 architecture or vfio_ccw are not indicated by the provided data as exposed.
What condition triggers the vulnerable cleanup path?
The path is entered when a device is lost and becomes non-operational. This can occur asynchronously from normal driver behavior, including while other locks such as the cio subchannel lock are held.
What is the remediation described by the fix?
The fix moves cleanup of private->cp resources to a workqueue so it runs outside the existing lock sequence. The provided references identify stable kernel commits containing the resolved change.