Improper resource shutdown or release in Linux kernel - CVE-2026-80555

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vfio_ccw channel program initialization logic when processing channel programs containing Transfer in Channel segments. A remote attacker can trigger cp_init() failure during ccwchain construction to cause a denial of service.

The issue occurs because cleanup does not release all allocated CCW segments if initialization fails before the channel program is marked initialized.

Affected software

How to mitigate CVE-2026-80555

External References

• https://git.kernel.org/stable/c/32e3d364a7b8295120d37e6a6bd433d2de26f748
• https://git.kernel.org/stable/c/4699b54fada156534cbb39834d47fc9374d7a1f5
• https://git.kernel.org/stable/c/6a917199aaf97904f5619afe3dfdacb155b03e8c
• https://git.kernel.org/stable/c/74186c2968f8f756ac3226b545b598457c910c75

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel s390 cio driver