CVE-2026-80551 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Ensure first IDAW remains constant
The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL.
Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel vulnerability identified within the s390 vfio_ccw subsystem centers on an inconsistency in how Interrupt Descriptor Address Word lists are processed during channel I/O operations. In IBM System z architecture, data structures known as Channel Program Description Lists utilize IDAWs to describe memory buffers for device communication. Typically, all but the first IDAW must be aligned to specific boundaries such as 2K or 4K pages to ensure efficient hardware processing and correct address calculation. However, because the first IDAW is exempt from this strict alignment requirement, it requires separate handling during buffer size calculations to accurately determine the total memory footprint of the channel program. This architectural nuance creates a potential race condition window where the kernel reads the initial descriptor without the same structural guarantees as subsequent descriptors, exposing the system to state inconsistency if the underlying memory changes concurrently with processing.
The core technical flaw lies in the lack of atomicity or verification when accessing the first IDAW within an untrusted user-space provided list via VFIO. When a virtual machine issues I/O commands through the vfio_ccw driver, it provides pointers and descriptors that map to guest physical memory. The kernel must read these descriptors from potentially shared or dynamically allocated memory regions. If the address stored in the first IDAW changes between the initial read used for size calculation and subsequent reads used for actual data transfer, the kernel may operate on a stale or mismatched set of addresses. This discrepancy can lead to the driver interpreting incorrect memory locations as valid buffers, effectively breaking the isolation guarantees provided by the virtualization layer. The failure to verify that the address found in the first IDAW remains unchanged between these critical read operations allows for a subtle but dangerous state divergence during execution.
From an operational impact perspective, this vulnerability enables potential privilege escalation and information disclosure attacks against the host system or other guest instances on the same physical hardware. An attacker with control over the virtual machine can manipulate memory contents to trigger this race condition. By rapidly modifying the first IDAW address in user space while the kernel is processing it, an attacker could cause the hypervisor to read data from unintended memory regions. This may result in the leakage of sensitive host kernel memory or other guest memories into the VM's output buffers. Furthermore, if the mismatched addresses point to writable kernel structures, a sophisticated exploit could lead to arbitrary code execution on the host by overwriting critical control flow data through improper DMA operations facilitated by the vfio_ccw driver.
This issue aligns with CWE-362, which describes concurrent access resulting in race conditions, specifically where shared resources are accessed without proper synchronization or verification of state consistency. Additionally, it relates to CWE-119, as the incorrect handling of memory boundaries and addresses can lead to out-of-bounds reads or writes when the kernel attempts to process a channel program based on corrupted descriptor data. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with Tactic TA0005 Defense Evasion through virtualization sandbox escape, allowing an adversary to bypass host-level security controls by exploiting hypervisor logic flaws. It also supports Data Exfiltration over Alternative Protocol channels if the leaked memory is transmitted back to the attacker via standard I/O completion paths.
Mitigation strategies primarily involve applying the upstream kernel patch that introduces explicit verification of the first IDAW address before and after processing steps. System administrators should ensure their Linux distributions are updated with the latest stable kernels containing this fix, particularly for s390x architectures utilizing VFIO-CCW devices such as FCP or HiperSockets. For environments where immediate kernel updates are not feasible, restricting access to vfio_ccw devices and ensuring that guest VMs do not have direct write access to memory regions mapped by these descriptors can reduce the attack surface. Additionally, enabling IOMMU protection features like AMD-Vi or Intel VT-d helps isolate DMA operations, limiting the potential impact of any successful exploitation attempt on host system integrity.