CVE-2026-80550

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-80550

Key Details

CVE	CVE-2026-80550
CVSS Score / Version	7.9 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is none; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is none; availability impact is low.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Fix out of bounds check on CCW array

The routine ccwchain_calc_length() counts the number of channel

command words (CCWs) that are chained together in a single channel

program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs.

The loop itself is "do..while (count < 257)", and while the logic in

is_cpa_within_range() correctly adjusts between the 0-index array of

CCWs and the count of CCWs starting at 1, this means it would look

at a possible 257th CCW before ending the loop and (correctly)

returning an error.

Fix this by restructuring the loop to break as soon as 256 CCWs

(thus indexes 0-255) are examined, without looking at memory

outside the range. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-80550
CVE	https://www.cve.org/CVERecord?id=CVE-2026-80550

Source

Reference

NVD

CVE