CVE-2026-80554: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80554 is a denial-of-service vulnerability in the Linux kernel's s390/vfio_ccw driver caused by an unbounded number of channel program segments during recursive processing. The vfio-ccw subsystem breaks channel programs into segments at each Transfer-In-Channel (TIC) CCW instruction, but prior to the fix, no limit was imposed on the total number of segments, enabling resource exhaustion. The vulnerability affects the Linux kernel from version 4.12 onward, with fixes backported to stable releases 6.6.153, 6.12.105, 6.18.46, 7.1.10, and mainline 7.2. It was published on August 26, 2026, and carries a CVSS v3.1 base score of 9.3 (Critical) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The vfio_ccw driver processes channel programs — sequences of Channel Command Words (CCWs) used on IBM s390 architecture — recursively. When a TIC CCW is encountered, the driver splits the channel program into a new segment and continues processing recursively; without a cap on the number of such segments, a malicious or malformed channel program can trigger unbounded recursion and resource consumption. Exploitation requires local access to the vfio-ccw interface (e.g., as a guest VM operator on an s390 host), with no privileges explicitly required per the CVSS vector (Red Hat Advisory, GitHub Advisory).

Successful exploitation causes a denial-of-service condition — the host system may hang or crash due to resource exhaustion triggered by excessive recursive channel program segment processing. The vulnerability has a Changed scope in its CVSS rating, meaning a guest VM user could impact the host kernel, affecting availability for all workloads on the system. Confidentiality and integrity impacts are also rated High in the CVSS score, though the primary real-world consequence is system unavailability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is limited to environments running IBM s390 hardware with vfio-ccw enabled, significantly narrowing the attack surface to specialized mainframe virtualization deployments.

Apply the available kernel patches that impose a limit on the number of channel program segments in the vfio-ccw driver. Fixed versions include Linux kernel 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2 (mainline). As a workaround, restrict access to vfio-ccw interfaces to trusted users only and monitor system resource usage for signs of resource exhaustion on the vfio-ccw subsystem (Red Hat Advisory, GitHub Advisory).