Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-26T15:17:09.863Z",
  "pubdate": "2026-08-26T15:17:09.863Z",
  "executiveSummary": "The Linux kernel s390/vfio_ccw subsystem contains a use-after-free vulnerability stemming from improper lifecycle management of asynchronous workqueues.\nThe vulnerability occurs when io_work and crw_work workqueues remain active after the associated private data structures are released during device teardown.\nThis flaw allows for potential memory corruption or kernel panics if the workqueue attempts to access the memory previously occupied by the private struct after it has been deallocated.\nThe impact is primarily a local denial-of-service, though it may provide vectors for arbitrary code execution in specific scenarios where the released memory is reallocated by the kernel.\nExploitation requires an attacker to trigger the device release process while the workqueues are pending, making this a race condition vulnerability.\nThe issue affects the s390 architecture within the vfio_ccw driver component.",
  "technicalDetails": "The vulnerability resides within the lifecycle management of the vfio_ccw driver for the s390 architecture. Specifically, the driver initializes two workqueues—io_work and crw_work—to handle asynchronous I/O and channel report word processing.\nThe root cause is a failure to safely tear down these workqueues when the associated private device structure is released. In the _release_dev function, the driver deallocates the private data structure; however, it fails to cancel or flush the pending work items.\nIf the kernel schedules these work items after the memory has been freed (a use-after-free scenario), the work items will attempt to dereference pointers within the now-freed private struct. Since this memory may have been reclaimed or reallocated for other kernel tasks, the execution flow is redirected to indeterminate memory addresses.\nThe attack flow involves: 1) The attacker initiates an operation that triggers the registration of the io_work or crw_work tasks. 2) The attacker triggers the destruction or removal of the vfio_ccw device. 3) The kernel executes _release_dev, freeing the private structure. 4) The previously queued work item executes, leading to a memory access violation or kernel fault when it accesses the freed pointers.\nThis behavior is classified as a use-after-free vulnerability, which can lead to kernel-level memory corruption. While the primary observable impact is a kernel panic resulting in a denial-of-service, a sophisticated attacker might attempt to exploit the race condition to manipulate the contents of the memory after it is freed to achieve privilege escalation or control flow integrity compromise.\nThe flaw affects the s390/vfio_ccw component of the Linux kernel. No authentication or specific network exposure is required to trigger this, as it is a local kernel driver issue. The exploitation success depends heavily on the timing of the workqueue dispatch relative to the device release process."
}