Executive brief
The Linux kernel's s390 vfio_ccw (channel command word) driver manages virtualized I/O operations on IBM System z mainframes. A missing bounds check allows out-of-bounds array access when reading or writing to region data, potentially exposing sensitive kernel memory or causing system crashes. This affects systems using virtualized channel I/O on s390 architecture.
Technical details
The vulnerability is a missing bounds check (CWE-129: Improper Validation of Array Index) in the vfio_ccw driver's read/write region handlers. The driver failed to validate that region index parameters were within the valid range before accessing the region array, despite similar validation being added elsewhere in the capability chain code. An unprivileged local user or guest with access to the vfio interface can provide an out-of-bounds index to trigger out-of-bounds array access. The attack requires network-adjacent or local access to the vfio device interface. Exploitation can lead to information disclosure (kernel memory read) or denial of service (kernel crash). The fix adds explicit bounds checks and uses array_index_nospec() to prevent speculative execution side channels in affected functions (vfio_ccw_async_region_read/write, vfio_ccw_schib_region_read, vfio_ccw_crw_region_read).
Affected products
- Linux Linux kernel s390 architecture; fix applies to Linux 5.x through 7.x mainline and stable branches
Timeline
- 2026-08-26: disclosed
- 2026-08-27: patched