CVE-2026-80554 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Limit the number of channel program segments
The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program.
The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's s390 vfio_ccw subsystem manages channel programs for virtualized I/O devices on IBM System z architecture, where input/output operations are executed via complex sequences known as Channel Programs. These programs consist of Channel Control Words (CCWs) that describe data transfers and control flow to hardware channels. A critical aspect of processing these programs is the recursive handling logic used by the kernel to traverse and validate them before submission to the virtualization layer. This recursion allows for nested structures within channel programs, such as those created when a Transfer-In-Channel CCW instructs the processor to jump to a different set of CCWs elsewhere in memory. While this design supports flexible I/O configurations, it introduces a risk related to resource exhaustion due to unbounded recursion depth if not properly constrained by architectural or software limits.
Previously, while there was an arbitrary limit on the total number of CCWs within a single channel program, there was no equivalent restriction applied specifically to the number of segments into which these programs are divided during processing. A segment is defined as a contiguous block of CCWs between Transfer-In-Channel instructions. When vfio_ccw processes a device request, it breaks down the incoming channel program into multiple segments based on TIC occurrences. The combined count of these segments contributes toward global resource limits, but without an explicit cap on the number of segments themselves, malicious or buggy guest virtual machines could construct deeply nested channel programs that trigger excessive recursion levels within the kernel space. This situation creates a potential vector for denial-of-service attacks against the host system, as the recursive processing can consume significant stack space and CPU resources, potentially leading to kernel panics or system instability under heavy load conditions crafted by an unprivileged user with access to VFIO devices.
This vulnerability is categorized under CWE-787: Out-of-bounds Write in terms of memory safety implications if recursion leads to buffer overflows on the call stack, and more accurately aligns with CWE-400: Uncontrolled Resource Consumption due to excessive resource usage from unbounded recursion. In the context of the MITRE ATT&CK framework for Linux systems, this flaw relates to techniques involving resource exhaustion within system processes, which can be exploited by local attackers who have been granted access to virtual function I/O devices through VFIO interfaces. The lack of a hard limit on segment counts allows an attacker to craft channel programs with deeply nested TIC chains that exceed safe recursion thresholds, thereby destabilizing the host kernel environment.
To mitigate this risk, developers imposed a strict equivalent limit on the number of segments allowed in a single channel program processing operation within the vfio_ccw driver logic. This change ensures that even if a guest attempts to create an excessively deep hierarchy of TIC jumps, the kernel will reject the request once the segment count exceeds the predefined threshold. This restriction acts as a safeguard against stack overflow conditions and excessive CPU consumption until the underlying recursive processing architecture can be refactored into an iterative approach that does not rely on call stack depth for traversal. Administrators should ensure their systems are updated with patches containing this fix to prevent potential denial-of-service scenarios arising from malformed channel programs submitted via VFIO devices, thereby maintaining system stability and security posture in virtualized s390 environments.