EUVD-2026-66470
GHSA-w6fw-g579-ffcw
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
PR:L applied because guest-level access to an assigned vfio_ccw device is a prerequisite; PR:N overstates universality of access within a guest.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Free all memory if cp_init() fails
The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory.
An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program.
Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.
AnalysisAI
Memory leak in the Linux kernel s390/vfio_ccw subsystem enables a guest VM user to exhaust host kernel memory by submitting crafted channel programs that trigger cp_init() failure paths, leaving ccwchain segments unfreed. Affected deployments are IBM s390 (mainframe) KVM hosts that have vfio channel command word (CCW) device passthrough configured, making the attack surface highly specific. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an IBM s390 (mainframe) architecture host running KVM, (2) at least one channel I/O device configured for vfio_ccw passthrough to a guest VM, and (3) guest-level access sufficient to submit channel programs through the vfio_ccw interface - no elevated privileges within the guest are required if the guest user has default device access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low-to-moderate despite the 7.1 CVSS score due to several strong limiting factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to a KVM guest on an IBM s390 host, where a vfio_ccw channel I/O device has been passed through, crafts a channel program containing Transfer in Channel (TIC) instructions that cause cp_init() to fail partway through segment processing. Repeated submission of such programs over time leaks progressively more host kernel memory for each orphaned ccwchain segment, eventually exhausting host memory and rendering the hypervisor unavailable to all tenants. … |
| Remediation | Apply the vendor-released kernel patch corresponding to the active stable branch: upgrade to Linux 6.12.105, 6.18.46, 7.1.10, or 7.2, available via kernel.org stable trees and distribution security channels. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM s390 KVM hosts in production with vfio-ccw device passthrough enabled and assess current guest isolation policies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today