EUVD-2026-66465
GHSA-fw9c-wxjq-5w67
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
AV:L reflects guest VM local access; PR:N applies within the guest; S:C captures the guest-to-host boundary crossing; C:H for host kernel memory disclosure; I:N as the flaw is read-only.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Fix out of bounds check on CCW array
The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.
The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.
Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
AnalysisAI
Out-of-bounds read in the Linux kernel's s390/vfio_ccw subsystem exposes host kernel memory to guest VM users, caused by an off-by-one error in the CCW chain length validation loop within ccwchain_calc_length(). Affected versions span from Linux 4.12 across multiple stable branches, with vendor-released patches confirmed in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following simultaneous conditions: (1) the host system must run Linux on s390/IBM Z hardware with the vfio_ccw kernel module compiled and loaded (CONFIG_VFIO_CCW=y); (2) at least one s390 channel I/O device must be assigned to a guest VM via vfio_ccw passthrough - this is a non-default, explicitly administrator-configured deployment; (3) the attacker must have code execution within that specific guest VM (no remote exploitation path exists); (4) within the guest, no elevated privilege is required - a user-level process with access to the vfio device node can submit channel programs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.9 with vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L correctly captures the guest-to-host scope change and potential for host kernel memory disclosure - even a mid-sized operator in rybnik running s390 mainframe workloads under KVM would need to evaluate this promptly given that C:H combined with S:C represents cross-boundary memory leakage from the host kernel. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with code execution inside a guest VM that has been assigned an s390 channel I/O device via vfio_ccw constructs a channel program containing exactly 257 chained CCWs and submits it to the host kernel via the vfio_ccw interface. The validation loop in `ccwchain_calc_length()` reads one CCW-sized structure beyond the end of the allocated array at index 256, potentially exposing adjacent host kernel memory contents to the attacker. … |
| Remediation | Upgrade to the applicable patched Linux kernel stable release: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2 depending on the branch in production use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all s390/IBM Z systems running Linux kernel versions 4.12 through 7.1.x with vfio_ccw device passthrough enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today