Executive brief
A race condition in the Linux kernel's s390 architecture VFIO channel I/O driver allows memory access to be manipulated between validation checks, enabling an attacker to bypass security controls and potentially access unauthorized memory or cause system instability. This affects systems running kernel-based virtual machines on IBM System z mainframes that use VFIO for direct I/O access.
Technical details
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race condition in drivers/s390/cio/vfio_ccw_cp.c within the indirect data address window (IDAW) handling code. The kernel reads the first IDAW address during buffer size calculation in ccw_count_idaws(), then reads it again later in get_guest_idal() without verifying the addresses match. An attacker with the ability to modify guest memory can change the IDAW address between these two reads, causing the kernel to validate one address but use a different one. The fix verifies the first IDAW address remains unchanged by storing and comparing it. No user interaction is required; exploitation requires local access or ability to modify guest memory in a KVM environment. The patch is available and has been backported to stable kernel versions.
Affected products
- Linux Linux kernel Affected versions prior to patch commit 565bef268d75bf7df665bce6923a88cd0eb74592 (introduced in commit 01aa26c672c0)
Timeline
- 2026-08-26: disclosed: CVE-2026-80551 published
- 2026-07-28: patched: Upstream patch commit 565bef268d75bf7df665bce6923a88cd0eb74592 authored
- 2026-08-23: other: Patch merged to stable kernels by Greg Kroah-Hartman