CVE-2026-80547

A MODERATE severity flaw was found in the Linux kernel's s390/vfio_ccw driver. The list of Channel Report Word (CRW) payloads, which is populated exclusively by asynchronous events from hardware, was managed without a dedicated lock. Concurrent access to this list from the asynchronous hardware-event path and userspace read or device-release paths can race, corrupting the CRW payload list and leading to data inconsistency or a host kernel crash on s390 systems that use vfio_ccw mediated channel devices. Red Hat rates this flaw MODERATE with CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): exploitation requires local access and privileges on an s390 system using a vfio_ccw mediated device, and the direct impact is denial of service; no confidentiality or integrity impact has been established. This differs from the upstream CVEORG rating of 8.8 (IMPORTANT), which assumes scope change with high confidentiality and integrity impacts that the available evidence does not support. Per the current assessment, the affected Red Hat offerings are the RHEL 9 and RHEL 10 kernel and kernel-rt components and the Red Hat In-Vehicle OS 2.0/2.1 kernel and kernel-ivos-qualcomm components, while the RHEL 6, 7, and 8 kernel and kernel-rt streams are marked not affected because the vulnerable code is not present in those streams. For the affected streams the fix is deferred to a future maintenance update given the MODERATE, availability-only nature of the issue; the residual risk is that a local privileged user on an affected s390 system using vfio_ccw could trigger kernel memory corruption resulting in a system crash.