CVE-2026-80550

A moderate out-of-bounds read flaw was found in the s390 vfio_ccw driver of the Linux kernel as shipped in Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS. The ccwchain_calc_length() routine counts the channel command words (CCWs) chained in a channel program submitted through a vfio-ccw mediated device and rejects programs longer than 256 CCWs, but its loop condition allowed a possible 257th CCW to be examined before the program was rejected, reading one element beyond the allocated CCW array. Exploiting this requires local, privileged access in a context that can submit channel programs to a vfio-ccw device on s390 hardware, for example a guest with such a device assigned; the flaw is not network-reachable. The main consequence assessed by Red Hat is an impact to system availability (kernel instability), with at most a theoretical disclosure of adjacent memory. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. For the affected releases the fix is deferred: the issue is a single-element out-of-bounds read restricted to specific s390 vfio-ccw configurations and rated moderate, so the residual risk is limited to s390 deployments that expose vfio-ccw mediated devices to privileged local users or guests until a fix is delivered. Red Hat rates this flaw MODERATE (CVSS 5.5, availability impact only), which differs from the upstream CVEORG rating of 7.9/IMPORTANT because the upstream score credits high confidentiality impact, whereas Red Hat's assessment finds the realistic impact to be availability.