Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-26T15:17:09.610Z",
  "pubdate": "2026-08-26T15:17:09.610Z",
  "executiveSummary": "A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists within the s390 architecture's vfio_ccw subsystem, specifically regarding the handling of Indirect Data Address Words (IDAWs).\nThe vulnerability involves the inconsistency between separate reads of the first IDAW, which can lead to a race condition where the pointer is modified by an attacker between the initial estimation of the buffer size and the subsequent retrieval of the full Indirect Data Address List (IDAL).\nThis flaw affects the Linux kernel vfio_ccw driver, which provides mediated device support for Channel Command Words (CCW) on IBM s390 systems.\nSuccessful exploitation could allow an attacker to bypass memory isolation constraints or cause kernel memory corruption.\nExploitation requires a local attacker to possess sufficient privileges to interact with the vfio-ccw interface, typically requiring access to the relevant vfio device file.\nThe risk implication is potential privilege escalation or denial of service through memory corruption triggered by race conditions in the IDAL processing logic.",
  "technicalDetails": "The core issue resides in the vfio_ccw subsystem's handling of channel programs, specifically where it calculates the memory requirements for an IDAL. In the s390 architecture, IDAWs act as pointers to data buffers. The first IDAW in a sequence is not strictly bound by standard alignment constraints (such as 2K or 4K boundaries) that apply to subsequent IDAWs.\nTo facilitate the retrieval of the full IDAL, the driver initially reads the first IDAW to determine the required buffer size before reading the entire list. However, because the kernel reads the first IDAW twice—once for size calculation and once for processing—a window of opportunity exists for a malicious user-space process to modify the memory location pointed to by the first IDAW during the interim period.\nThe attack flow initiates when the guest or user-space process submits a CCW request containing an IDAL. The kernel driver performs a read operation on the guest memory to fetch the first IDAW. An attacker, having concurrent access to the shared memory region, replaces the contents of the first IDAW after the kernel has read it for the initial size calculation but before it reads it for the final processing.\nBecause the subsequent read operation relies on the potentially tainted data, the kernel may operate on an inconsistent view of the IDAL. This discrepancy between the anticipated structure (based on the initial read) and the actual structure (based on the manipulated second read) can lead to buffer overflows or the processing of incorrect memory addresses.\nThe vulnerable component is identified within the logic that parses CCW requests, specifically the IDAL processing routines. The fix involves ensuring that the first IDAW remains immutable between the initial check and the final utilization. By caching the result of the first read and verifying that the value remains consistent, the kernel prevents the race condition that allows for IDAL modification.\nThis vulnerability highlights a critical lack of atomicity in memory access patterns within the vfio_ccw framework, where guest-controlled memory is accessed multiple times without sufficient synchronization or verification of the input's state across those access operations."
}