EUVD-2026-66467
GHSA-fp69-7jh5-pp7r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local access to vfio_ccw device requires PR:L and AV:L; Scope:Changed reflects guest-to-host boundary crossing; all three impact metrics high given potential kernel memory corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Ensure index for read/write regions are within range
The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced.
AnalysisAI
Out-of-bounds region index access in the Linux kernel's s390/vfio_ccw subsystem exposes systems to potential guest-to-host privilege escalation on IBM mainframe KVM deployments. The read/write region handlers lack the bounds clamping that was applied to the capability chain regions, allowing a low-privileged local attacker - typically a KVM guest with vfio_ccw passthrough access - to trigger out-of-bounds memory access with a CVSS Scope:Changed impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be satisfied simultaneously: (1) the target system must be IBM s390/z-architecture hardware - this vulnerability does not exist on x86, ARM, or any other architecture; (2) the Linux kernel must have the vfio_ccw module loaded and a CCW device configured for VFIO passthrough to a KVM guest - this is not a default configuration and must be explicitly provisioned; (3) the attacker must be operating within a guest VM that has been granted access to the vfio_ccw passthrough device, corresponding to the CVSS PR:L (low-privilege) requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is the dominant risk signal here, and the Scope:Changed metric is the most consequential element - it reflects the guest-to-host boundary that vfio_ccw straddles, meaning a successful exploit within a KVM guest could affect host kernel integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operating within a KVM guest on an IBM s390 system with vfio_ccw passthrough configured submits a crafted region access request using an out-of-bounds index targeting the read/write region handler. The absent bounds check allows the kernel to access memory outside the region array, either leaking kernel memory contents (information disclosure) or corrupting kernel memory (if a write path is reachable). … |
| Remediation | Upgrade to a patched kernel version: 6.1.184 or later in the 6.1.x LTS branch, 6.6.153 or later in the 6.6.x LTS branch, 6.12.105 or later in the 6.12.x branch, 6.18.46 or later in the 6.18.x branch, 7.1.10 or later in the 7.1.x branch, or 7.2 and above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM mainframe KVM systems with vfio_ccw passthrough enabled and identify currently running Linux kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today