CVE-2026-80550: s390/vfio_ccw: Fix out of bounds check on CCW array
In the Linux kernel, the following vulnerability has been resolved:
s390/vfioccw: Fix out of bounds check on CCW array
The routine ccwchaincalclength() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAINLENMAX (256) CCWs.
The loop itself is "do..while (count < 257)", and while the logic in iscpawithinrange() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.
Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the s390 vfio_ccw code path. The provided information does not identify affected kernel versions or configuration prerequisites beyond that component.
What condition is required to trigger the out-of-bounds access?
A channel program must contain a CCW chain exceeding the permitted 256 CCWs. The vulnerable loop can examine a possible 257th CCW before rejecting the chain.
What is the remediation?
Apply a Linux kernel update containing the fix that stops processing once 256 CCWs, corresponding to array indexes 0 through 255, have been examined. The supplied references identify stable kernel commits carrying the correction.