{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80547", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.766Z", "datePublished": "2026-08-26T14:37:18.159Z", "dateUpdated": "2026-08-27T12:40:07.162Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:40:07.162Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Implement a crw lock\n\nUnlike the channel_program struct, which covers synchronous I/O\nsubmissions and asynchronous interrupts, the CRW region relies\nexclusively on asynchronous events coming from hardware.\n\nImplement a lock to manage the list of those payloads, to ensure\nthey are read cohesively."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached only via local VFIO mediated-device access (read/ioctl on /dev/vfio/* device fds) to the CCW CRW region; vfio-ccw has no network, Bluetooth, or physical-bus packet entry point.\nAC:L - The attacker controls CRW region reads and can retry concurrently while channel-path events queue CRWs via vfio_ccw_chp_event(); this user-versus-hardware/workqueue list race is winnable without conditions outside attacker influence.\nPR:L - Triggering requires an opened vfio-ccw mdev fd (typical QEMU/libvirt VM operator or delegated /dev/vfio holder on IBM Z passthrough hosts), not init-namespace root; admin creates the mdev but exploitation needs only that VFIO client access.\nUI:N - No separate victim action is required; once vfio-ccw passthrough is configured, the attacker repeatedly reads the CRW region while guest/channel I/O generates asynchronous path events without needing another user to interact.\nS:C - On IBM Z/LinuxONE, vfio-ccw passes DASD subchannels into KVM guests; guest-driven channel activity causes host-side CRW queuing while the VFIO client reads the CRW region, corrupting hypervisor kernel memory outside the VM security boundary.\nC:H - Unsynchronized list_del/list_add/kfree on kmalloc vfio_ccw_crw objects is a use-after-free/list-corruption primitive; per kernel guidance this enables attacker-influenced heap reuse and arbitrary kernel memory disclosure.\nI:H - Corrupted list pointers and freed CRW entries allow heap-sprayable arbitrary writes and control-flow hijack beyond a simple crash, matching kernel guidance for use-after-free and memory corruption bugs.\nA:H - Concurrent unsynchronized list manipulation can immediately oops or panic the host kernel via invalid list operations or double-free, and successful exploitation can hang or crash the entire system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/cio/vfio_ccw_chp.c", "drivers/s390/cio/vfio_ccw_drv.c", "drivers/s390/cio/vfio_ccw_ops.c", "drivers/s390/cio/vfio_ccw_private.h"], "versions": [{"version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "lessThan": "3c94d4179bcc19e01b28db634c07a58b28116209", "status": "affected", "versionType": "git"}, {"version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "lessThan": "0edd222730a9d7ec98368aaf1d40ee2d8d862e61", "status": "affected", "versionType": "git"}, {"version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "lessThan": "a3d60ae24183eee352c8e87a0ff94c97cd87f156", "status": "affected", "versionType": "git"}, {"version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "lessThan": "49fa26b0df009dc1f420980bd71780e70615b83b", "status": "affected", "versionType": "git"}, {"version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "lessThan": "7902be374cbfc11c3435e1e87bf22195bf06a558", "status": "affected", "versionType": "git"}, {"version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "lessThan": "c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9", "status": "affected", "versionType": "git"}, {"version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "lessThan": "16b0798024c0e9117e395829ddbbe70981c79d9c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/cio/vfio_ccw_chp.c", "drivers/s390/cio/vfio_ccw_drv.c", "drivers/s390/cio/vfio_ccw_ops.c", "drivers/s390/cio/vfio_ccw_private.h"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.218", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.185", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.154", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.218"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3c94d4179bcc19e01b28db634c07a58b28116209"}, {"url": "https://git.kernel.org/stable/c/0edd222730a9d7ec98368aaf1d40ee2d8d862e61"}, {"url": "https://git.kernel.org/stable/c/a3d60ae24183eee352c8e87a0ff94c97cd87f156"}, {"url": "https://git.kernel.org/stable/c/49fa26b0df009dc1f420980bd71780e70615b83b"}, {"url": "https://git.kernel.org/stable/c/7902be374cbfc11c3435e1e87bf22195bf06a558"}, {"url": "https://git.kernel.org/stable/c/c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9"}, {"url": "https://git.kernel.org/stable/c/16b0798024c0e9117e395829ddbbe70981c79d9c"}], "title": "s390/vfio_ccw: Implement a crw lock", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/s390/cio/vfio_ccw_chp.c", "drivers/s390/cio/vfio_ccw_drv.c", "drivers/s390/cio/vfio_ccw_ops.c", "drivers/s390/cio/vfio_ccw_private.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3c94d4179bcc19e01b28db634c07a58b28116209", "status": "affected", "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "versionType": "git"}, {"lessThan": "0edd222730a9d7ec98368aaf1d40ee2d8d862e61", "status": "affected", "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "versionType": "git"}, {"lessThan": "a3d60ae24183eee352c8e87a0ff94c97cd87f156", "status": "affected", "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "versionType": "git"}, {"lessThan": "49fa26b0df009dc1f420980bd71780e70615b83b", "status": "affected", "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "versionType": "git"}, {"lessThan": "7902be374cbfc11c3435e1e87bf22195bf06a558", "status": "affected", "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "versionType": "git"}, {"lessThan": "c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9", "status": "affected", "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "versionType": "git"}, {"lessThan": "16b0798024c0e9117e395829ddbbe70981c79d9c", "status": "affected", "version": "3f02cb2fd9d2d9e8762102886e3e4b51285797ee", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/s390/cio/vfio_ccw_chp.c", "drivers/s390/cio/vfio_ccw_drv.c", "drivers/s390/cio/vfio_ccw_ops.c", "drivers/s390/cio/vfio_ccw_private.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.218", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.185", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.154", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Implement a crw lock\n\nUnlike the channel_program struct, which covers synchronous I/O\nsubmissions and asynchronous interrupts, the CRW region relies\nexclusively on asynchronous events coming from hardware.\n\nImplement a lock to manage the list of those payloads, to ensure\nthey are read cohesively."}], "id": "CVE-2026-80547", "lastModified": "2026-08-27T13:18:39.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:17:09.087", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0edd222730a9d7ec98368aaf1d40ee2d8d862e61"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/16b0798024c0e9117e395829ddbbe70981c79d9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c94d4179bcc19e01b28db634c07a58b28116209"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49fa26b0df009dc1f420980bd71780e70615b83b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7902be374cbfc11c3435e1e87bf22195bf06a558"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3d60ae24183eee352c8e87a0ff94c97cd87f156"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/vfio_ccw: Implement a crw lock", "id": "2524420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524420"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/vfio_ccw: Implement a crw lock\nUnlike the channel_program struct, which covers synchronous I/O\nsubmissions and asynchronous interrupts, the CRW region relies\nexclusively on asynchronous events coming from hardware.\nImplement a lock to manage the list of those payloads, to ensure\nthey are read cohesively.", "A flaw was found in the Linux kernel's `s390/vfio_ccw` component. This vulnerability arises from the lack of a proper lock to manage the list of Channel Report Word (CRW) payloads, which are asynchronous events from hardware. Without this lock, these payloads may not be read cohesively, potentially leading to data inconsistency or unexpected system behavior."], "name": "CVE-2026-80547", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80547\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80547\nhttps://lore.kernel.org/linux-cve-announce/2026082607-CVE-2026-80547-4c7e@gregkh/T"], "threat_severity": "Moderate"}