CVE-2026-80554

A denial of service flaw was found in the Linux kernel s390 vfio_ccw driver, affecting Red Hat Enterprise Linux and Red Hat In-Vehicle OS with moderate impact. The vfio-ccw logic processes channel programs, and the Channel Command Words (CCWs) within them, recursively, and splits a channel program into segments whenever it encounters a Transfer-In-Channel (TIC) CCW. While an arbitrary limit exists on the number of CCWs in a channel program, the number of segments was not similarly limited. A local attacker with the ability to submit channel programs to a vfio-ccw passthrough device, for example from a guest on an s390 (IBM Z) host using vfio-ccw channel device passthrough, could supply a channel program that generates an excessive number of segments, driving uncontrolled recursive processing and excessive resource consumption, resulting in a denial of service that makes the system unavailable. Only s390 systems that use vfio-ccw device passthrough are exposed. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rather than the CVE.org Critical score of 9.3 because exploitation requires local access with the privilege to submit channel programs and the impact is limited to availability. Red Hat Enterprise Linux 6, 7, and 8 streams are not affected because the vulnerable code is not present in those releases. The fix for the affected Red Hat Enterprise Linux 9, 10, and Red Hat In-Vehicle OS streams is deferred to a future update; the upstream resolution imposes a limit on the number of channel program segments as an interim measure until the recursive processing logic can be made non-recursive. The residual risk of the deferral is a local denial of service by an attacker who can already submit channel programs to a vfio-ccw device on an affected s390 host.