CVE-2026-80553

Received Received - Intake

s390/vfio_ccw Workqueue Cleanup Flaw

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80553

EUVD

EUVD-2026-66468

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper cleanup of workqueues in the s390/vfio_ccw driver. The io_work and crw_work workqueues are initialized but not properly uninitialized during device release, which could lead to work being dispatched after the associated data structures are freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/vfio_ccw component and involves improper cleanup of workqueues. Detection requires checking kernel logs for related errors or crashes, particularly during device release operations. Commands like 'dmesg | grep vfio_ccw' or 'journalctl -k | grep vfio_ccw' may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability may cause system instability or crashes if workqueues attempt to access freed memory. It primarily affects systems using the s390/vfio_ccw driver, potentially leading to denial-of-service conditions or other unexpected behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel memory management issue in the s390/vfio_ccw driver. No evidence suggests data exposure or privacy risks.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80553. Check your distribution's security advisories for the specific kernel version addressing this issue.

Hi! I’m here to help you understand CVE-2026-80553. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70