CVE-2026-80555 json
s390/vfio_ccw: Free all memory if cp_init() fails
published 2026-08-26 2 mo ago modified 2026-08-27 2 mo ago also EUVD-2026-66470
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Free all memory if cp_init() fails
The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory.
An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program.
Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.
Patch / fix
- Linux Linux 5.10.267, 5.15.218, 6.1.185, 6.6.154, 6.12.105, 6.18.46, 7.1.10, 7.2
- linux Debian 12 6.1.187-1
- linux Debian 13 6.12.105-1
- linux Debian 14 7.1.10-1
- linux-6.12 Debian 12 6.12.107-1~deb12u1
debian advisories DEBIAN-CVE-2026-80555
- linux Ubuntu 22.04 LTS 5.15.0-202.212
- linux Ubuntu 26.04 LTS 7.0.0-42.42
- linux-aws Ubuntu 22.04 LTS 5.15.0-1119.126
- linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1120.130
- linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
- linux-gke Ubuntu 22.04 LTS 5.15.0-1115.121
- linux-ibm Ubuntu 22.04 LTS 5.15.0-1113.117
ubuntu advisories UBUNTU-CVE-2026-80555
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- git.kernel.org/stable/c/276bd7ed34d56c48c65c43c0b08f2ee77029b2fa commit
- git.kernel.org/stable/c/f9bcff265556796834122f95de16d52a8375206c commit
- git.kernel.org/stable/c/17e01e342af74de12899c206dcc9ec90684703aa commit
- git.kernel.org/stable/c/152fcb74a26804b70909381c6acc90595a0ae1c1 commit
- git.kernel.org/stable/c/6a917199aaf97904f5619afe3dfdacb155b03e8c commit
- git.kernel.org/stable/c/32e3d364a7b8295120d37e6a6bd433d2de26f748 commit
- git.kernel.org/stable/c/4699b54fada156534cbb39834d47fc9374d7a1f5 commit
- git.kernel.org/stable/c/74186c2968f8f756ac3226b545b598457c910c75 commit
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/276bd7ed34d56c48c65c43c0b08f2ee77029b2fa
- git.kernel.org /stable/c/f9bcff265556796834122f95de16d52a8375206c
- git.kernel.org /stable/c/17e01e342af74de12899c206dcc9ec90684703aa
- git.kernel.org /stable/c/152fcb74a26804b70909381c6acc90595a0ae1c1
- git.kernel.org /stable/c/6a917199aaf97904f5619afe3dfdacb155b03e8c
- git.kernel.org /stable/c/32e3d364a7b8295120d37e6a6bd433d2de26f748
- git.kernel.org /stable/c/4699b54fada156534cbb39834d47fc9374d7a1f5
- git.kernel.org /stable/c/74186c2968f8f756ac3226b545b598457c910c75
Sources
- CVE List CVE-2026-80555
- NVD CVE-2026-80555
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.