EUVD-2026-66462
GHSA-9vqh-hxm7-9fwm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Race condition requires precise concurrent timing (AC:H); low privilege sufficient within guest; scope changes as host hypervisor kernel state is affected beyond the vulnerable vfio_ccw component.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Implement a crw lock
Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware.
Implement a lock to manage the list of those payloads, to ensure they are read cohesively.
AnalysisAI
Race condition in the Linux kernel's s390/vfio_ccw CRW (Channel Report Word) subsystem allows low-privileged local attackers on IBM mainframe KVM hosts to read incoherent CRW payload state, with CVSS-assessed potential for high confidentiality, integrity, and availability impact including scope change into the hypervisor. The root cause is an absent lock on the CRW payload list, which receives exclusively asynchronous hardware events and was therefore never protected for concurrent access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the host must be an IBM s390 (zSeries/mainframe) system - no other architecture is affected; (2) the vfio_ccw kernel module must be loaded and a channel device must be configured for passthrough to a KVM guest; (3) the attacker must have low-privilege access in a guest VM or on the host sufficient to influence or observe CRW-generating hardware events. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.8 with scope change (S:C/C:H/I:H/A:H) reflects worst-case hypervisor boundary impact but requires critical context: this vulnerability is exclusively relevant to s390 (IBM mainframe) KVM hosts with vfio_ccw device passthrough configured - a small subset of all Linux deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege guest access on an s390 KVM host configured with vfio_ccw passthrough generates a high-frequency burst of CRW-inducing hardware error events, racing the unlocked CRW payload list between the async interrupt handler and the guest reader. The incoherent list state could expose a stale or partially-overwritten CRW payload containing host kernel memory fragments, or corrupt the CRW queue in a way that disrupts I/O processing for other guests sharing the channel subsystem. … |
| Remediation | Upgrade to Linux kernel 6.12.105, 6.18.46, 7.1.10, or 7.2, which include the CRW lock implementation per EUVD-2026-66462. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM mainframe KVM hosts to identify systems running affected kernel versions (6.12.x through 7.1.x prior to patches). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today