CVE-2026-80550 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Fix out of bounds check on CCW array
The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.
The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.
Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel vulnerability identified in the s390 vfio_ccw subsystem involves an out-of-bounds read within the ccwchain_calc_length function. This routine is responsible for calculating the length of a chain of Channel Command Words, which are fundamental control structures used in IBM mainframe architecture to manage input/output operations between devices and memory. The specific flaw arises from the loop structure employed to iterate through these CCWs. The original implementation utilized a do-while construct with the condition count less than 257, effectively allowing the iteration to proceed until the count reaches two hundred fifty-seven. While the internal logic correctly adjusts for zero-based indexing versus one-based counting in subsequent checks such as is_cpa_within_range, the loop itself performs an access operation before evaluating whether it should terminate. Consequently, when a chain contains exactly 256 valid CCWs, corresponding to array indices zero through two hundred fifty-five, the loop executes one additional iteration. This results in the function attempting to read memory at index two hundred fifty-six, which lies outside the allocated bounds of the CCW array.
This out-of-bounds access constitutes a classic buffer over-read vulnerability where the kernel attempts to dereference memory that is not part of the intended data structure. Although the loop eventually returns an error due to subsequent validation logic preventing further processing of invalid chains, the act of reading beyond the allocated boundary can have significant security implications. In many contexts, accessing unmapped or protected memory regions triggers a page fault exception, potentially leading to a kernel panic and system crash if not handled gracefully by the architecture-specific fault handlers. Even in cases where the out-of-bounds address happens to map to valid but unintended memory, it may expose sensitive information contained within adjacent data structures, facilitating potential information disclosure attacks. Furthermore, depending on how the surrounding code handles the return value or state after this erroneous read, there could be subtle logic errors that compromise system stability or integrity.
From a classification perspective, this vulnerability aligns with CWE-125, which describes out-of-bounds read vulnerabilities where software reads data past the end of a buffer. It also relates to CWE-787, as improper bounds checking allows access to memory locations outside intended boundaries. In terms of attack vectors and techniques, this flaw could be leveraged by an attacker with local access who can influence or control the CCW chain parameters passed to the vfio_ccw driver. By crafting a maliciously structured channel program that triggers this specific boundary condition, an adversary might induce a denial-of-service state through kernel instability or potentially probe memory contents for information gathering purposes. This scenario is consistent with ATT&CK technique T1083, which involves file and directory discovery, although in the context of kernel vulnerabilities, it often extends to broader system enumeration and stability disruption tactics found under privilege escalation paths if combined with other flaws.
The resolution implemented by the Linux kernel developers addresses this issue by restructuring the loop logic within ccwchain_calc_length. Instead of relying on a do-while construct that inherently executes at least once before checking the termination condition, the fix ensures that the iteration breaks immediately after examining two hundred fifty-six CCWs. This adjustment guarantees that only array indices zero through two hundred fifty-five are accessed, strictly adhering to the defined maximum length constant CCWCHAIN_LEN_MAX. By preventing any access beyond index two hundred fifty-five, the vulnerability is eliminated at its source without altering the functional outcome for valid inputs or correctly rejecting invalid ones.
To mitigate similar risks in kernel development and maintain system security, it is essential to enforce strict bounds checking during all memory access operations involving user-supplied data or dynamically allocated structures. Developers should prefer while loops over do-while constructs when the number of iterations depends on a condition that might be met immediately upon entry, thereby avoiding unnecessary execution steps. Additionally, employing static analysis tools and fuzzing techniques can help identify such off-by-one errors before they reach production kernels. Regular code reviews focusing on array indexing logic and boundary conditions are critical for maintaining robustness in low-level system components like device drivers. Ensuring that all iterative processes respect the allocated memory limits prevents not only out-of-bounds reads but also potential write vulnerabilities, thereby preserving the confidentiality, integrity, and availability of the operating environment.