EUVD-2026-66469
GHSA-42gq-4mc2-p2hw
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Requires local access to a passed-through CCW device (PR:L) on s390 vfio-ccw; guest-to-host recursion gives S:C with availability-dominant impact (A:H), minimal integrity and no clear confidentiality loss.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Limit the number of channel program segments
The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program.
The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive.
AnalysisAI
Uncontrolled recursion in the Linux kernel's s390 vfio-ccw driver lets a local actor on IBM Z (s390) hosts submit a channel program containing an unbounded number of chained CCW/Transfer-in-Channel (TIC) segments, which are processed recursively and can exhaust the kernel stack. Affected are s390 systems using vfio-ccw device passthrough to KVM guests; the impact is host instability and potential kernel memory corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an s390 (IBM Z) host running the vfio-ccw driver with a CCW I/O device passed through to a guest, and a local actor (typically a malicious or compromised KVM guest) able to submit channel programs to that mediated device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and warrant caution before treating the 9.3 headline score at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with control of a KVM guest that has been assigned a passed-through CCW device via vfio-ccw crafts a channel program with a long chain of TIC CCWs, forcing the host driver to recurse through an excessive number of segments. This exhausts the host kernel stack, crashing the host or potentially corrupting adjacent kernel memory across the guest-to-host boundary. … |
| Remediation | Upgrade the kernel to a fixed stable release - 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2 (or your distribution's backport that includes the s390 vfio-ccw segment-limit patch); the corresponding upstream commits are at https://git.kernel.org/stable/c/15fb4559a7fdf0b8725e433a71cfd03a1313a48b and the sibling stable commits listed in the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit infrastructure to identify all s390 systems running vfio-ccw device passthrough and categorize by business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today