Executive brief
A race condition exists in the Linux kernel's s390 vfio_ccw (channel command word) driver due to improper mutex scoping around I/O region access and channel program operations. An attacker with local access to a system using this driver could trigger a data race, potentially leading to memory corruption or denial of service in virtualized mainframe I/O operations.
Technical details
The vulnerability is a race condition (CWE-362) in the s390/vfio_ccw driver where the io_mutex protecting concurrent access to I/O regions and channel programs was not held consistently across related operations. Specifically, mutex acquisition points were not correctly positioned around operations in vfio_ccw_crw_region_read(), cp_iova_pinned(), and vfio_ccw_sch_io_todo(), allowing multiple threads to simultaneously access and modify shared I/O structures. The patch expands the mutex scope to cover all critical sections. Attack vector requires local access to the vfio_ccw device; a fix is available in the Linux kernel stable releases.
Affected products
- Linux Linux kernel affected versions prior to fix commit 34f4feff3e90bd09308fad0974e97113b23b812a
Timeline
- 2026-08-26: disclosed
- 2026-07-28: patched