CVE-2026-80548

Received Received - Intake

s390/vfio_ccw io_mutex Expansion Fix in Linux Kernel

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_regions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of races that are possible, the choices are either to: A) expand the scope of io_mutex to close these remaining windows, or B) reduce the scope of io_mutex to just io_region, and introduce a new lock mechanism for the remaining I/O resources This patch implements A, since B brings with it a lot more interactions that would need to be tracked and kept in a correct hierarchy. It also takes advantage of the workqueue element for cp_free() that now gets called out of fsm_notoper(), which could be invoked out of an interrupt context and thus cannot acquire a mutex itself.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80548

EUVD

EUVD-2026-66463

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the s390/vfio_ccw driver related to io_mutex. The io_mutex was originally meant to serialize io_regions but ended up being loosely associated with I/O operations. The patch resolves potential races by expanding the scope of io_mutex to cover these remaining issues, rather than introducing a new lock mechanism.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/vfio_ccw component and involves race conditions in io_mutex usage. Detection requires checking kernel logs for related errors or kernel crashes involving vfio_ccw or io_mutex. Commands like dmesg | grep vfio_ccw or journalctl -k | grep vfio_ccw may help identify issues.

Impact Analysis

This vulnerability could lead to race conditions in I/O operations on s390 systems using vfio_ccw, potentially causing data corruption, system instability, or unexpected behavior in virtualized environments. However, the impact is limited to specific kernel subsystems and hardware.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel race condition in s390/vfio_ccw io_mutex handling. No evidence suggests data exposure or privacy violations typical of compliance violations.

Mitigation Strategies

Apply the kernel patch that resolves this issue by updating to a patched Linux kernel version. Monitor vendor advisories for kernel updates addressing CVE-2026-80548. If immediate patching is not possible, restrict access to s390 systems using vfio_ccw until the patch is applied.

Hi! I’m here to help you understand CVE-2026-80548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70