Executive brief
The Linux kernel's s390 vfio_ccw driver failed to properly cancel pending work items when a device is closed or released, allowing queued work to execute after internal data structures are freed. An attacker with local access to a system using this virtualized I/O interface could exploit this to cause a kernel crash or potentially execute arbitrary code.
Technical details
This is a use-after-free vulnerability in the s390/vfio_ccw driver's device release and close paths. The io_work and crw_work workqueues were initialized but never properly cancelled during device shutdown, allowing pending work items to reference freed memory structures. The fix adds cancel_work_sync() calls in both vfio_ccw_mdev_release_dev() and vfio_ccw_mdev_close_device() to drain pending work before the private data structure is deallocated. The vulnerability requires local kernel access and the vfio_ccw device to be actively used, making the attack vector local rather than remote.
Affected products
- Linux Linux kernel prior to commit 79c60b2c61105368dcc8444eb45847e21734f7c4
Timeline
- 2026-08-26: disclosed
- 2026-08-27: patched