Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-26T15:17:09.723Z",
  "pubdate": "2026-08-26T15:17:09.723Z",
  "executiveSummary": "The Linux kernel s390/vfio_ccw component contains an out-of-bounds vulnerability resulting from improper input validation regarding region indexes.\nThis vulnerability is classified as an improper index validation issue, where read/write operations fail to verify that requested region indexes reside within the valid addressable range defined for the device.\nThe flaw affects the vfio_ccw subsystem, which facilitates device passthrough for channel I/O on IBM Z architectures.\nAn unprivileged or low-privileged user with access to the vfio device file could potentially trigger an out-of-bounds read or write operation, leading to memory corruption or kernel-level information disclosure.\nThe primary risk involves the compromise of kernel integrity or unauthorized access to sensitive memory regions associated with the vfio_ccw backend, depending on how the out-of-bounds offset is utilized by an attacker.\nSuccessful exploitation requires local access to the s390 system and the ability to interact with the vfio_ccw device interface, typically via user-space drivers or malicious virtual machine configurations.",
  "technicalDetails": "The vulnerability resides within the vfio_ccw driver's handling of memory-mapped regions in the Linux kernel on the s390 architecture. The vfio_ccw subsystem allows user-space applications, such as QEMU/KVM, to manage channel I/O devices directly by exposing them via the vfio framework.\nThe root cause of this flaw is the lack of strict bounds checking when processing read and write requests for legacy region indexes. While the recent introduction of capability chains successfully implemented index clamping for capability-based regions, the legacy read/write regions were excluded from this validation logic.\nIn the affected implementation, the code fails to verify that a requested index is not exceeding the total number of defined regions. Consequently, a malicious user-space process can provide an arbitrary, out-of-bounds index when invoking read or write operations via the vfio file descriptor.\nThe attack flow follows a predictable pattern: first, the attacker gains access to the vfio_ccw device node. Second, the attacker prepares a crafted read or write system call (e.g., pread/pwrite) targeting the vfio device file. Within the driver's handler for these operations, the kernel iterates through or indexes into an internal array representing device regions using the attacker-supplied index.\nBecause the driver performs no bounds check, it treats the out-of-bounds index as a valid offset into memory, potentially accessing adjacent kernel data structures or pointers. If an out-of-bounds read is performed, the attacker may leak sensitive kernel memory contents back to user space. If an out-of-bounds write is performed, the attacker may overwrite adjacent memory, leading to kernel panic, denial of service, or potentially code execution if sensitive control structures are targeted.\nThe vulnerability is present in all versions of the vfio_ccw driver that implement legacy region access without the mandatory index validation logic. This issue is specific to the kernel-side handling of the vfio interface on s390 and does not require network exposure, as it relies on local system interaction with the device driver."
}