CVE-2026-80550 s390/vfio_ccw: Fix out of bounds check on CCW array
A local attacker can trigger an out-of-bounds read in the s390 vfio_ccw driver, potentially leaking kernel memory or causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80550?
CVE-2026-80550 is a high-severity memory corruption vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Fix out of bounds check on CCW array
The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.
The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.
Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
Which versions are affected by CVE-2026-80550?
How do I fix CVE-2026-80550?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80550 being exploited?
There is no known exploitation of CVE-2026-80550 in the wild and no public exploit code.
Sources
Also known as AZL-97713, BELL-CVE-2026-80550, DEBIAN-CVE-2026-80550, GHSA-fw9c-wxjq-5w67, UBUNTU-CVE-2026-80550.