Executive brief
The Linux kernel's s390 VFIO CCW (virtual function I/O channel command word) driver manages asynchronous hardware events called Channel Report Words (CRWs) without proper synchronization. Multiple code paths can access and modify the CRW event queue concurrently, leading to data corruption or loss of critical I/O event notifications that could cause virtualized I/O devices to malfunction or lose operational state.
Technical details
The vulnerability is a data race (CWE-366) in the s390/vfio_ccw driver's CRW region handling. The CRW event list is accessed asynchronously from multiple contexts (interrupt handlers and read operations) without spinlock protection, unlike the synchronous channel_program struct. An attacker or concurrent hardware events can cause unsynchronized reads/writes to the CRW list, potentially corrupting the event queue. The fix adds spin_lock_irqsave/spin_unlock_irqrestore calls around list access operations in vfio_ccw_crw_region_read() and vfio_ccw_crw_todo() to ensure atomic list manipulation. This is a kernel-internal fix with no direct network attack vector; exploitation requires the ability to trigger concurrent CRW events on a virtualized s390 system.
Affected products
- Linux Linux kernel affected versions in s390 architecture (vfio_ccw driver)
Timeline
- 2026-08-26: disclosed
- 2026-08-27: patched: Stable kernel commit merged