Bug 2524463 (CVE-2026-80550)

Summary: CVE-2026-80550 kernel: s390/vfio_ccw: Fix out of bounds check on CCW array
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the `s390/vfio_ccw` component of the Linux kernel. The `ccwchain_calc_length()` routine, which counts channel command words (CCWs), incorrectly checked array boundaries. This could lead to an out-of-bounds read, where the system attempts to access memory beyond its allocated limits. Such an issue could potentially cause system instability or lead to the disclosure of sensitive information.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-26 14:57:50 UTC 
In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Fix out of bounds check on CCW array

The routine ccwchain_calc_length() counts the number of channel
command words (CCWs) that are chained together in a single channel
program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.

The loop itself is "do..while (count < 257)", and while the logic in
is_cpa_within_range() correctly adjusts between the 0-index array of
CCWs and the count of CCWs starting at 1, this means it would look
at a possible 257th CCW before ending the loop and (correctly)
returning an error.

Fix this by restructuring the loop to break as soon as 256 CCWs
(thus indexes 0-255) are examined, without looking at memory
outside the range.
Comment 1 gkamathe 2026-08-27 09:54:48 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082608-CVE-2026-80550-5cb8@gregkh/T