Linux Kernel EUVD-2026-66470

Exploitation requires: (1) an IBM s390 (mainframe) architecture host running KVM, (2) at least one channel I/O device configured for vfio_ccw passthrough to a guest VM, and (3) guest-level access sufficient to submit channel programs through the vfio_ccw interface - no elevated privileges within the guest are required if the guest user has default device access. The vulnerability is triggered only when cp_init() fails mid-processing of a channel program that includes Transfer in Channel (TIC) operations creating multiple ccwchain segments; single-segment programs without TIC instructions do not produce the multi-segment leak. Exploitation is limited to availability impact (memory exhaustion on host); there is no direct path to confidentiality or integrity compromise. The niche s390 vfio_ccw deployment model and requirement for prior guest VM access are the primary limiting factors beyond raw CVSS metrics.

Real-world risk is low-to-moderate despite the 7.1 CVSS score due to several strong limiting factors. First, the attack surface is restricted to IBM s390 (mainframe) KVM deployments with vfio_ccw device passthrough configured - an architecture used primarily in large banking and government sectors. Second, the attacker must already have access inside a guest VM with a CCW device assigned. Third, there is no CISA KEV listing and no public exploit or proof-of-concept identified, and no EPSS score was provided to assess probability of near-term exploitation. The CVSS vector AV:L/AC:L/PR:N is worth scrutiny: PR:N implies no privileges required, which is reasonable if the guest user has default access to the assigned vfio_ccw device, while S:C correctly captures host-side impact from a guest-originating trigger. The availability impact (A:H) is realistic only under sustained or automated exploitation causing kernel memory exhaustion on the host; a single failed channel program produces a small leak. This is a real but niche defect warranting patch prioritization in s390 KVM environments but is not a broad enterprise priority.

An attacker with access to a KVM guest on an IBM s390 host, where a vfio_ccw channel I/O device has been passed through, crafts a channel program containing Transfer in Channel (TIC) instructions that cause cp_init() to fail partway through segment processing. Repeated submission of such programs over time leaks progressively more host kernel memory for each orphaned ccwchain segment, eventually exhausting host memory and rendering the hypervisor unavailable to all tenants. No public proof-of-concept has been identified, and the precise trigger conditions for reliable cp_init() failure from guest input require further technical investigation.