Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-26T00:00:00 kernel: s390/vfio_ccw: Limit the number of channel program segments 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-770

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive.

A flaw was found in the Linux kernel's s390/vfio_ccw component. The vfio-ccw logic processes channel programs recursively, breaking them into segments when a Transfer-In-Channel (TIC) Channel Command Word (CCW) is encountered. An attacker could exploit the lack of a proper limit on these segments, leading to excessive resource consumption. This could result in a denial of service, making the system unavailable.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-80554 https://nvd.nist.gov/vuln/detail/CVE-2026-80554 https://lore.kernel.org/linux-cve-announce/2026082608-CVE-2026-80554-aead@gregkh/T