{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_cp.c",
            "drivers/s390/cio/vfio_ccw_cp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15fb4559a7fdf0b8725e433a71cfd03a1313a48b",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "a1625f66eaa1200068a0e2c05bc90e65182fc4e3",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "4ee94790490ae8dcc97df8597f07836c8a81bbcf",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            },
            {
              "lessThan": "5405c90d6a47b3014e74ee0618a162449abbbc93",
              "status": "affected",
              "version": "0a19e61e6d4c6192077ead760ba0a2d350987d4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/cio/vfio_ccw_cp.c",
            "drivers/s390/cio/vfio_ccw_cp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Limit the number of channel program segments\n\nThe processing of channel programs, and the CCWs within them, is done\nrecursively. As such, there is an arbitrary (but not architectural)\nlimit to the number of CCWs that can exist in a single channel program.\n\nThe vfio-ccw logic breaks these channel programs into segments whenever\nit encounters a Transfer-In-Channel (TIC) CCW, and the combined number\nof segments count towards the global limit. Impose an equivalent limit\nto the number of segments until such logic can be made non-recursive."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via local VFIO-ccw mediated-device write()/ioctl on the I/O region (QEMU relaying guest SSCH/channel programs into fsm_io_request\u2192cp_init); no network, adjacent-radio, or physical-bus handler processes guest channel programs.\nAC:L - Attacker fully controls guest channel program layout and can chain many unique TIC targets so ccwchain_handle_ccw()/ccwchain_loop_tic() recurse without bound until host kernel stack exhaustion; no race, timing, or uncontrollable memory layout is required.\nPR:N - A malicious VM guest with an assigned vfio-ccw mediated subchannel needs no host credentials or capabilities; it only issues guest I/O that QEMU forwards, requiring none of the administrator privileges used to create the mdev.\nUI:N - Exploitation requires only the attacker\u0027s own guest channel program submission through normal passthrough I/O; no separate victim mount, click, or user action is needed once the device is assigned.\nS:C - Guest-supplied channel programs are parsed recursively in host kernel cp_init(), so stack corruption crosses the guest-to-host VFIO device-passthrough boundary and can compromise the hypervisor and co-resident VMs.\nC:H - Unbounded recursion corrupts the host kernel stack frame, enabling disclosure of adjacent stack/kernel memory and supporting further exploitation beyond a mere crash.\nI:H - Stack overflow in ccwchain_handle_ccw() yields attacker-influenced host kernel stack corruption plausibly enabling control-flow hijacking and arbitrary host kernel code execution.\nA:H - Deep recursion reliably causes host kernel stack exhaustion, oops, or panic, crashing the hypervisor and all VMs on the system at guest will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:42.432Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15fb4559a7fdf0b8725e433a71cfd03a1313a48b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1625f66eaa1200068a0e2c05bc90e65182fc4e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/06f4d6e5a8af6c2072e8cd39dbc512c683ca7fb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ee94790490ae8dcc97df8597f07836c8a81bbcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5405c90d6a47b3014e74ee0618a162449abbbc93"
        }
      ],
      "title": "s390/vfio_ccw: Limit the number of channel program segments",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80554",
    "datePublished": "2026-08-26T14:37:22.376Z",
    "dateReserved": "2026-08-26T14:34:25.766Z",
    "dateUpdated": "2026-08-27T05:01:42.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}