EUVD-2026-66464
GHSA-664j-v92h-9gpp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
AC raised to H because exploitation depends on asynchronous race timing; AV:L and PR:H reflect s390-local vfio_ccw administrative access requirement.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Move cp cleanup out of not operational
The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the cio subchannel lock).
Push the cleanup of the private->cp resources to a workqueue, where it can be done out from under that lock sequence and a future patch can safely manage the locking requirements.
AnalysisAI
Improper lock-aware cleanup in the s390/vfio_ccw subsystem of the Linux kernel exposes host systems to memory corruption when a virtualized channel device transitions to a non-operational state. The fsm_notoper() routine, invoked asynchronously upon device loss, performs private->cp resource cleanup while potentially holding the CIO subchannel lock, creating a lock inversion or use-after-free condition that crosses the VM-to-host boundary (CVSS S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) IBM Z (s390) hardware or an IBM Z LPAR environment, as this code path does not exist on x86/ARM; (2) a Linux guest with at least one vfio_ccw channel device actively passed through from the host; (3) high-privilege access within the guest or host to trigger or wait for a device non-operational event; (4) a specific timing window where fsm_notoper() is invoked asynchronously while the CIO subchannel lock is held. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a high-severity local vulnerability with scope change, suggesting the impact crosses from the guest/VM context into the host or hypervisor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An administrator with high privileges over a KVM guest on IBM Z hardware that has a vfio_ccw channel device assigned triggers a device loss event - either through a genuine hardware fault or by forcing a device detach - while the CIO subchannel lock is held by another kernel path. The race causes fsm_notoper() to execute cp cleanup in a lock-conflicting or use-after-free context, potentially corrupting host kernel memory structures. … |
| Remediation | The primary remediation is to upgrade to a patched Linux kernel stable release: 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2, all of which include the workqueue-deferred cleanup fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running s390 Linux kernels with vfio_ccw enabled and determine current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today