CVE-2026-80555: s390/vfio_ccw: Free all memory if cp_init() fails
In the Linux kernel, the following vulnerability has been resolved:
s390/vfioccw: Free all memory if cpinit() fails
The routine cpfree() is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch() fails. But if cpinit() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory.
An attempt to address this exists in ccwchainhandleccw(), where a single call to ccwchainfree() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program.
Address this by performing the cleanup outside of the recursive ccwchainhandleccw()/ccwchainlooptic() logic.
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope?
The issue is in the Linux kernel's s390 vfio_ccw code path. It concerns channel programs that create additional CCW segments through Transfer in Channel processing.
What failure condition triggers the memory leak?
The leak occurs when cp_init() fails before cp->initialized is enabled. In that state, cp_free() cannot perform the normal full cleanup.
Why is freeing the currently processed CCW segment insufficient?
A single ccwchain_free() call for the current segment does not release other segments allocated for the same channel program. Those additional segments can have been created during recursive Transfer in Channel handling.