CVE-2026-80547 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Implement a crw lock
Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware.
Implement a lock to manage the list of those payloads, to ensure they are read cohesively.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability addressed in this update pertains to the s390 architecture within the Linux kernel's VFIO CCW subsystem, specifically involving race conditions related to asynchronous hardware interrupts and channel report word handling. The Channel Report Word region serves as a critical communication mechanism between the z/Architecture hardware and the guest operating system or host kernel for reporting status changes in I/O operations. Unlike synchronous I/O submissions which are managed through structured channel programs with explicit state transitions, the CRW region relies exclusively on asynchronous events triggered by external hardware devices. This reliance introduces complexity because multiple interrupts can arrive concurrently, potentially leading to inconsistent states if not properly serialized during processing.
The core technical flaw lies in the lack of atomicity when accessing and modifying the list of payloads associated with these channel report words. Without a dedicated lock mechanism, concurrent access from different execution contexts or interrupt handlers could result in data corruption, lost updates, or invalid pointer dereferences. The previous implementation did not enforce mutual exclusion on the operations that read and manage these asynchronous event payloads, creating a window where race conditions could occur. This is particularly dangerous because it affects the integrity of I/O state tracking, which is fundamental to virtualization stability and security.
From an industry standards perspective, this issue aligns with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization. The absence of proper locking mechanisms on shared data structures accessed by multiple threads or interrupt handlers constitutes a classic synchronization error. In the context of MITRE ATT&CK, while not directly exploitable for initial access in most scenarios, such vulnerabilities can be leveraged during lateral movement or privilege escalation if an attacker can trigger specific hardware states to cause denial-of-service conditions through kernel panics or memory corruption. The vulnerability highlights risks associated with CWE-674: Uncontrolled Recursion and CWE-823: Use of Out-of-range Pointer Offset, as improper handling of asynchronous lists may lead to invalid memory accesses.
The operational impact of this flaw includes potential system instability, unpredictable behavior in virtualized environments, and possible denial-of-service conditions for workloads relying on VFIO CCW devices. In severe cases, race conditions could allow an unprivileged user or compromised guest VM to influence host kernel state, potentially leading to information disclosure or code execution if the corrupted data structures are later used by privileged routines. The fix implements a dedicated lock specifically designed to manage the list of payloads within the CRW region, ensuring that reads and modifications occur cohesively without interference from concurrent asynchronous events.
Mitigation strategies involve applying the kernel patch that introduces this synchronization primitive immediately after its release in updated distributions. For systems unable to update promptly, administrators should consider isolating workloads that heavily utilize s390 VFIO CCW devices or limiting their exposure until the fix is deployed. Monitoring logs for unusual I/O errors or system crashes related to channel subsystem operations can help detect exploitation attempts or instability caused by this race condition. Long-term remediation requires rigorous code review practices focused on concurrent access patterns in kernel drivers, particularly those handling asynchronous hardware interrupts and shared resource management.