Bug 2524507 (CVE-2026-80549)

Summary:	CVE-2026-80549 kernel: s390/vfio_ccw: Move cp cleanup out of not operational
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's s390/vfio_ccw component. When a device is lost, the `fsm_notoper()` routine performs cleanup while potentially holding other locks, such as the `cio` subchannel lock. This improper handling of resource cleanup in an asynchronous context could lead to a deadlock, causing system instability or a denial of service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-26 15:03:19 UTC

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Move cp cleanup out of not operational

The fsm_notoper() routine is called when the device has been
lost, and is (by definition) no longer operational. Since this
can happen asynchronously from the normal behavior of the
driver, the cleanup may happen when holding other locks
in the calling sequence (notably, the cio subchannel lock).

Push the cleanup of the private->cp resources to a workqueue,
where it can be done out from under that lock sequence and
a future patch can safely manage the locking requirements.

Comment 1 gkamathe 2026-08-27 14:01:08 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082607-CVE-2026-80549-2908@gregkh/T