EUVD-2026-66468
GHSA-rq35-rvjv-r5cq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local low-privileged access triggers kernel use-after-free with scope change because vfio_ccw corruption can propagate to the KVM hypervisor layer beyond the faulting process.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Cancel existing workqueues
The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd.
AnalysisAI
Use-after-free in the Linux kernel's s390/vfio_ccw subsystem allows a local low-privileged user on IBM Z hardware to corrupt freed kernel memory by triggering workqueue dispatch after the owning private struct has been released. Affected systems are those running KVM guests with VFIO CCW I/O channel passthrough on s390 architecture, spanning kernel versions from 4.12 through multiple unpatched stable branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access (AV:L per CVSS) to an IBM Z (s390) system - this vulnerability does not affect any non-s390 architecture. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score with scope change (S:C) is credible for a kernel use-after-free at the hypervisor-guest boundary: a corrupted kernel could compromise the host or adjacent VMs, justifying the elevated impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a low-privileged account on an IBM Z system running KVM guests with vfio_ccw I/O passthrough triggers a race condition by causing the vfio_ccw private struct to be released - for example by closing the VFIO device file descriptor - while io_work or crw_work callbacks are still queued. The workqueue dispatches after the private struct is freed, causing kernel code to access dangling pointers, which an attacker could leverage through heap shaping techniques to achieve kernel code execution and escalate to root or compromise the KVM hypervisor. … |
| Remediation | Update the Linux kernel to a patched stable release: 6.6.153 or later for the 6.6.x LTS branch, 6.12.105 or later for the 6.12.x LTS branch, 6.18.46 or later for the 6.18.x branch, 7.1.10 or later for the 7.1.x branch, or 7.2 for the mainline series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Z systems running Linux kernel versions 4.12 through current stable branches with KVM virtualization and VFIO CCW device assignment enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today