Executive brief
The Linux kernel's VFIO CCW (channel command word) driver for IBM S390 systems has a memory leak when channel program initialization fails. If an initialization error occurs, allocated memory for I/O transfer segments is not properly freed, potentially exhausting system memory over time and causing system instability or denial of service.
Technical details
The vulnerability is a resource leak (CWE-401) in the s390/vfio_ccw subsystem's channel program initialization code. When cp_init() calls cp_prefetch() which then invokes ccwchain_handle_ccw() and the recursive ccwchain_loop_tic() logic, a failure in cp_init() results in incomplete cleanup. While ccwchain_handle_ccw() attempted to free the current segment on error, it did not account for multiple segments (chains) created via Transfer in Channel (TIC) instructions that were allocated earlier in the same channel program, leading to memory leak. The fix introduces ccwchain_build_ccws() as a wrapper that iterates through all allocated ccwchain entries and properly frees them on error. Attack vector is local; an unprivileged user with access to vfio_ccw devices can trigger channel program initialization failures repeatedly to cause memory exhaustion.
Affected products
- Linux Linux kernel multiple versions before 6.10 and other stable branches
Timeline
- 2026-08-26: disclosed: Published in NVD
- 2026-07-28: patched: Fix committed upstream by Eric Farman