Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_regions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of races that are possible, the choices are either to: A) expand the scope of io_mutex to close these remaining windows, or B) reduce the scope of io_mutex to just io_region, and introduce a new lock mechanism for the remaining I/O resources This patch implements A, since B brings with it a lot more interactions that would need to be tracked and kept in a correct hierarchy. It also takes advantage of the workqueue element for cp_free() that now gets called out of fsm_notoper(), which could be invoked out of an interrupt context and thus cannot acquire a mutex itself.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-26T15:17:09.200Z",
  "pubdate": "2026-08-26T15:17:09.200Z",
  "executiveSummary": "The Linux kernel s390/vfio_ccw driver contained a race condition vulnerability stemming from improper synchronization of I/O operations and io_regions.\nThe vulnerability type is a race condition (Concurrency Flaw) resulting from insufficiently scoped locking mechanisms.\nThe impact includes potential memory corruption, kernel panics, or use-after-free scenarios if conflicting I/O operations are processed simultaneously.\nAffected systems are s390 architecture-based Linux kernel environments utilizing the vfio_ccw subsystem for device passthrough.\nThe risk implication involves unauthorized state transitions or improper resource cleanup, potentially leading to denial-of-service or privilege escalation.\nAn attacker would need the ability to interact with the VFIO interface, which typically requires CAP_SYS_ADMIN capabilities in the host or specific device assignment permissions, to trigger the race condition by rapidly initiating concurrent I/O operations.",
  "technicalDetails": "The vulnerability resides in the s390/vfio_ccw driver, which is responsible for mediating I/O for channel-attached devices within a Virtual Function I/O (VFIO) framework.\nHistorically, the io_mutex was primarily intended to serialize access to io_regions. However, due to the tight coupling between io_regions and the underlying I/O operations, the lock was also used to protect I/O state transitions.\nThe root cause was the insufficient scope of the io_mutex, which failed to cover specific execution windows where asynchronous events—such as state changes triggered by interrupts or asynchronous I/O completion—could conflict with user-space initiated I/O requests.\nExploitation occurs when an attacker triggers concurrent I/O operations through the vfio_ccw interface. Because the locking granularity was inconsistent, a race condition window existed where a secondary thread could modify or free internal data structures (such as Channel Programs) while the primary thread was mid-execution of an I/O operation.\nA critical challenge identified in the design was the requirement for cp_free() to be called from within fsm_notoper(). Since fsm_notoper() can be invoked from an interrupt context, it cannot perform a mutex_lock() operation, as mutexes are sleepable locks.\nThe resolution involves expanding the scope of the io_mutex to ensure holistic serialization of both region access and I/O command processing. This effectively closes the race windows that previously existed during the submission and cleanup phases of channel programs.\nThe patch ensures that the critical paths involved in device state management are protected against concurrent access by strictly enforcing the acquisition of the io_mutex before modifying any shared internal state, thereby preventing the race condition that led to the inconsistent kernel memory states."
}