EUVD-2026-66466
GHSA-p29x-7599-2m4p
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Local guest access able to submit channel programs (PR:L), a timing-dependent double-fetch race raises AC:H, and guest-to-host escape gives S:C with high C/I/A.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Ensure first IDAW remains constant
The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL.
Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with.
AnalysisAI
Host-side memory corruption/information disclosure in the Linux kernel s390 vfio_ccw driver allows a malicious or compromised KVM guest on IBM Z mainframes to exploit a double-fetch race when the driver reads a guest-supplied IDAL (Indirect Data Address List). Because the first IDAW is read separately to size the transfer buffer, a guest that changes that address between reads can desynchronize the buffer size from the actual IDAW set, corrupting or leaking host memory (S:C, C:H/I:H/A:H, CVSS 9.3). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target host to be an s390/IBM Z system running KVM with an s390 channel (CCW) device passed through to a guest via the vfio_ccw driver, and the attacker must control that guest and be able to submit channel programs containing an IDAL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and require careful weighing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who controls a KVM guest on an IBM Z host that has a CCW device assigned via vfio_ccw crafts a channel program with an IDAL and, using a second thread, races to modify the first IDAW's address in guest memory between the driver's sizing read and its data read. The resulting mismatch between the allocated buffer size and the actual IDAWs lets the attacker corrupt or read host kernel memory, potentially escaping the guest. … |
| Remediation | Upstream fix available (commits/stable backports); update to a patched stable kernel - the fix is present in stable releases such as 6.12.105 and 6.18.46 (and later series per EUVD), or apply the commits at git.kernel.org/stable/c/0d46c2565f173bcddcdcaf44a4f69789a20535e2, /08ef2a82115690d6e229615872ac1731af732497, /fc59e9482117ebdccd6dc7fa8082f8b980fd021e and /565bef268d75bf7df665bce6923a88cd0eb74592, then confirm the exact patched version shipped by your distribution vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM Z systems running Linux kernel with KVM and the vfio_ccw driver; contact your Linux distribution vendor (Red Hat, SUSE, Canonical, or equivalent) for the specific patched kernel version required for your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today