Executive brief
A flaw in the Linux kernel's s390 virtual I/O (vfio) channel command word (CCW) processing allows the kernel to read memory outside the bounds of a validated array. Systems running affected kernel versions on s390 architecture hardware could experience memory access violations that lead to information disclosure or kernel instability when processing I/O channel programs.
Technical details
The vulnerability exists in ccwchain_calc_length() within the s390/vfio_ccw driver (drivers/s390/cio/vfio_ccw_cp.c). The function validates channel command word chains and enforces a maximum limit of CCWCHAIN_LEN_MAX (256) CCWs. The original loop structure used "do..while (count < 257)" which would read a 257th array element before checking the boundary condition, causing an out-of-bounds memory access. The fix restructures the loop to use a for-loop with bounds "cnt <= CCWCHAIN_LEN_MAX" that prevents accessing beyond index 255. No authentication is required; the vulnerability can be triggered by any process with vfio_ccw access. The impact is memory disclosure or kernel denial of service. Patches are available in upstream kernel and stable branches.
Affected products
- Linux Linux kernel All versions with vfio_ccw driver support (introduced in 4.12, fixed in 2026-08-23)
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched: Patch applied to stable kernel branches and upstream