Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the cio subchannel lock). Push the cleanup of the private->cp resources to a workqueue, where it can be done out from under that lock sequence and a future patch can safely manage the locking requirements.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-26T15:17:09.323Z",
  "pubdate": "2026-08-26T15:17:09.323Z",
  "executiveSummary": "The vulnerability involves a potential deadlock condition within the s390 vfio_ccw driver's Finite State Machine (FSM) implementation.\nThe issue stems from the cleanup of channel program (cp) resources being performed synchronously within the fsm_notoper() routine while holding critical internal locks, specifically the cio subchannel lock.\nBy triggering the not-operational state transition asynchronously, the driver attempts to perform resource deallocation while the execution context remains tied to the caller's locked state.\nThis creates an environment susceptible to circular wait conditions or lock recursion, which can lead to system-wide kernel panics or denial-of-service (DoS) scenarios.\nThe flaw affects the Linux kernel on the s390 architecture within the vfio_ccw subsystem.\nExploitation does not require external network access but relies on the ability of a user-space process to interact with vfio-ccw devices to induce a state change that invokes fsm_notoper().\nSuccessful exploitation results in kernel-level resource starvation or system freezing, effectively compromising the availability of the affected host.",
  "technicalDetails": "The root cause of this vulnerability is improper lock ordering and context management within the s390 vfio_ccw driver’s fsm_notoper() function. The function is designed to handle device state transitions when a device is marked as not operational, typically due to hardware failure or removal.\nIn the original implementation, fsm_notoper() initiated the cleanup of private->cp (channel program) resources directly. However, because this function is called within contexts where the cio subchannel lock is already held, attempting to free these resources synchronously creates a violation of standard locking hierarchies. Specifically, if the cleanup process requires further interaction with the subchannel layer or if other concurrently executing kernel tasks contend for the same spinlocks, a deadlock state is initialized.\nThe attack flow follows this sequence: 1) A user-space process initiates a vfio-ccw operation, establishing the necessary kernel context and locking the subchannel structures. 2) An asynchronous event triggers the hardware's not-operational condition. 3) The kernel invokes fsm_notoper() to transition the FSM. 4) The routine attempts to deallocate the channel program resources while the cio subchannel lock is still held by the caller. 5) A deadlock occurs as the thread attempts to acquire or re-acquire locks, or due to a circular dependency in the driver's resource management chain.\nBecause the vulnerability is triggered by the driver's internal state management, it constitutes a local denial-of-service risk. The vulnerable component is the vfio_ccw FSM handler. The state of the kernel is compromised when the synchronization primitives are bypassed or misused during the asynchronous tear-down process.\nBy moving the cleanup of the private->cp resources to a workqueue, the kernel ensures that the resource deallocation is executed outside of the restricted lock sequence of the calling routine. This offloads the resource cleanup to a system worker thread, allowing it to acquire or release locks as necessary without interfering with the primary subchannel locking sequence that originated the state change."
}