Executive brief
The Linux kernel's vfio-ccw subsystem (used for virtualization of channel I/O devices on IBM System z mainframes) contained an unbounded recursion vulnerability in its channel program processing logic. A local attacker could craft malicious channel programs with excessive Transfer-In-Channel (TIC) instructions to cause kernel stack overflow, leading to denial of service or potentially arbitrary code execution.
Technical details
The vulnerability exists in the vfio-ccw channel program interpreter (drivers/s390/cio/vfio_ccw_cp.c), which recursively processes channel command word (CCW) chains. When encountering a TIC (Transfer-In-Channel) instruction, the code allocates new chain segments without imposing a limit on their total count. This allows an attacker to craft a malicious channel program with many chained segments that exhaust kernel stack space during recursive processing. The fix introduces CCWCHAIN_COUNT_MAX (set to 16) to limit the number of segments, rejecting requests exceeding this threshold. Attack requires local access to vfio-ccw device interfaces on a system with s390 virtualization enabled. Patch available in upstream Linux kernel and backported to stable branches.
Affected products
- Linux Linux kernel Multiple versions including linux-5.x, linux-6.x, and linux-7.x series
Timeline
- 2026-08-26: disclosed
- 2026-07-28: patched: Fix authored by Eric Farman