CVE-2026-80547: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80547 is an improper resource locking vulnerability in the Linux kernel's s390/vfio_ccw module that can enable local privilege escalation. The flaw exists because the CRW (Channel Report Word) region, which handles asynchronous hardware events, lacks a proper lock to manage concurrent access to its payload list. It affects Linux kernel versions from 5.8 up to (but not including) the fixed releases. Fixed versions include 6.12.105, 6.18.46, 7.1.10, and 7.2. It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-413 (Improper Resource Locking). Unlike the channel_program struct — which handles both synchronous I/O submissions and asynchronous interrupts with appropriate locking — the CRW region in vfio_ccw relies exclusively on asynchronous events from hardware and previously had no lock protecting its payload list. This creates a race condition where concurrent access to CRW payloads can result in inconsistent reads, potentially allowing a low-privileged local user to trigger undefined kernel behavior and escalate privileges. The fix introduces a dedicated lock (crw lock) to ensure CRW payloads are read cohesively (Red Hat Advisory, Red Hat Bugzilla).

A local user with low-level privileges on s390 systems can exploit this race condition to execute arbitrary code with kernel privileges, effectively achieving full privilege escalation. The changed scope means the impact extends beyond the vulnerable component itself, potentially affecting other processes and security boundaries on the host. Confidentiality, integrity, and availability are all rated as High impact, meaning a successful exploit could lead to complete system compromise, data exfiltration, or denial of service (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date. The vulnerability requires local access with low privileges on an s390 system running a vulnerable kernel version with the vfio_ccw module in use. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, Red Hat Bugzilla).

Apply the upstream kernel patches that introduce the CRW lock fix. Fixed versions are Linux kernel 6.12.105, 6.18.46, 7.1.10, and 7.2. The relevant upstream commits are 49fa26b0df009dc1f420980bd71780e70615b83b, 7902be374cbfc11c3435e1e87bf22195bf06a558, c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9, and 16b0798024c0e9117e395829ddbbe70981c79d9c. As a workaround prior to patching, restrict local user access to vfio_ccw devices on s390 systems and ensure only trusted users have permissions to interact with channel I/O virtualization interfaces (Red Hat Bugzilla, Red Hat Advisory).