Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.9",
  "pubDate": "2026-08-26T15:17:09.477Z",
  "pubdate": "2026-08-26T15:17:09.477Z",
  "executiveSummary": "The Linux kernel s390 vfio_ccw component contains an out-of-bounds (OOB) memory access vulnerability during the calculation of Channel Command Word (CCW) chain lengths.\nThis vulnerability is classified as an improper bounds check, potentially leading to memory corruption or read access outside of the allocated buffer when processing malicious CCW chains.\nThe issue resides in the ccwchain_calc_length() function, which incorrectly validates CCW counts by allowing the loop to iterate up to 257 times, despite the defined maximum of 256.\nSuccessful exploitation could allow a local attacker, typically one with access to vfio_ccw device interfaces, to trigger a kernel-space memory read or cause a system crash through a denial-of-service (DoS) attack.\nThe risk is localized to the s390 architecture and requires the ability to interact with the vfio_ccw subsystem. No network-based remote exploitation is implied by this specific flaw.",
  "technicalDetails": "The vulnerability is situated within the ccwchain_calc_length() function in the Linux kernel's s390 vfio_ccw driver. This function is responsible for traversing and counting CCWs chained together within a channel program to ensure they adhere to hardware and driver constraints.\nThe root cause of the vulnerability is an off-by-one error in the loop termination logic. The implementation utilized a 'do-while' loop structure with the condition 'count < 257'. Because CCWs are indexed from 0 to 255 (a maximum of 256 CCWs), the existing logic permitted the loop to evaluate the 257th CCW before terminating.\nDuring the iteration process, the function invokes is_cpa_within_range(). While this sub-routine attempts to reconcile the index-based range check with the total count, the loop condition allows the logic to attempt to access memory beyond the valid bounds of the CCW array when a chain of maximum length is provided.\nAn attacker capable of crafting a malicious channel program can supply a chain of CCWs that forces the loop to reach the 257th iteration. Because the driver expects a maximum of 256 entries, the 257th access results in reading memory adjacent to the CCW array.\nThe exploitation flow involves: 1) The attacker configuring a vfio_ccw device. 2) The attacker injecting a specifically crafted CCW chain that is precisely 257 entries long (or longer if not caught). 3) The kernel driver, while attempting to validate the length, processes the out-of-bounds memory address. 4) The resulting OOB access can lead to the retrieval of unauthorized kernel memory or, more commonly, a kernel panic due to a segmentation fault or memory access violation, resulting in a denial-of-service.\nThe vulnerability exposes kernel memory state if the OOB read is leveraged by other kernel mechanisms or leads to instability. The lack of strict boundary enforcement in the loop structure is the primary failure point, as it violates the security invariant that no more than 256 CCWs should be processed per chain."
}