CVE-2026-80555

Received Received - Intake

Memory Leak in Linux Kernel s390/vfio_ccw

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80555

EUVD

EUVD-2026-66470

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves memory leaks in the s390/vfio_ccw driver. When the cp_init() function fails, memory allocated for I/O operations is not properly freed. The existing cleanup mechanism misses freeing memory for other segments in the channel program, leading to resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/vfio_ccw driver and involves memory leaks during I/O operations. Detection requires checking kernel logs for errors related to vfio_ccw or CCW (Channel Command Word) handling. Use commands like dmesg | grep vfio_ccw or journalctl -k | grep vfio_ccw to inspect kernel messages for failures in cp_init() or memory leaks.

Impact Analysis

This vulnerability could lead to memory exhaustion on systems using the s390/vfio_ccw driver. Over time, unaddressed memory leaks may cause system instability, crashes, or degraded performance due to resource depletion.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory leak issue in the Linux kernel's s390/vfio_ccw driver, which could lead to resource exhaustion but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the latest kernel patches or updates that address this issue. If patches are unavailable, consider disabling the vfio_ccw driver if not required. Monitor system memory usage for leaks and restart affected services if errors are detected.

Hi! I’m here to help you understand CVE-2026-80555. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70