Executive brief
The s390/vfio_ccw driver, used to manage channel I/O virtual devices on IBM System z servers, is vulnerable to a deadlock condition when a device becomes lost or non-operational. The driver's cleanup code runs synchronously while holding critical locks, which can cause the system to hang and deny service to applications using virtualized channel I/O functionality.
Technical details
The vulnerability is a deadlock/locking issue in the s390/vfio_ccw driver's fsm_notoper() routine. When a channel I/O device becomes non-operational (device lost), the driver attempts to clean up channel program resources while holding the CIO subchannel lock. Since this can happen asynchronously, the synchronous cleanup code can deadlock when other kernel code holds related locks in the calling sequence. The fix defers the cp_free() cleanup to a workqueue (vfio_ccw_notoper_todo), allowing it to execute outside the lock hierarchy. The vulnerability affects systems running Linux with the s390/vfio_ccw driver, requiring local or administrative access to trigger via device hot-unplug or loss scenarios.
Affected products
- Linux Linux kernel Multiple versions prior to fix (commit 0c11f61a876ed6fcca53d442ed3f33ea8362a0f9)
Timeline
- 2026-08-26: disclosed: CVE-2026-80549 published
- 2026-07-28: patched: Patch committed (0c11f61a876ed6fcca53d442ed3f33ea8362a0f9)