Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-26T15:17:10.130Z",
  "pubdate": "2026-08-26T15:17:10.130Z",
  "executiveSummary": "The Linux kernel component s390/vfio_ccw contains a memory leak vulnerability triggered during error handling in the CCW (Channel Command Word) chain initialization process.\nThe vulnerability stems from inadequate cleanup logic within the cp_init() failure path, leading to orphaned memory segments when processing CCW chains that include Transfer in Channel (TIC) segments.\nThis flaw can be exploited to facilitate a kernel-level denial-of-service (DoS) condition by exhausting available system memory through repeated triggering of the failed allocation path.\nAffected systems are restricted to those utilizing the vfio_ccw driver on s390 architecture. Exploitation requires the attacker to have sufficient privileges to interact with the VFIO interface, typically requiring access to the device file associated with the mediated CCW device.\nThe risk is categorized as moderate due to the necessity of local access and the specific operational requirements to trigger the initialization failure.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper management of memory allocated for CCW chains in the s390/vfio_ccw driver. The function cp_init() is responsible for initializing channel program structures; however, if this function fails, the existing cleanup routine cp_free() is insufficient because it relies on the cp->initialized flag, which is not set if initialization fails early.\nWhen processing CCW chains that involve a Transfer in Channel (TIC), the driver recursively invokes ccwchain_handle_ccw() and ccwchain_loop_tic() to build a chain of segments. The current implementation attempts a localized cleanup by calling ccwchain_free() only for the segment currently being processed during the recursion upon encountering a failure.\nThis design fails to account for memory allocated for preceding segments or subsequent segments in the channel program that were already initialized prior to the failure point. Because the failure occurs deep within the recursive logic, the driver loses track of these already-allocated objects, and they are not returned to the memory allocator, resulting in a persistent kernel memory leak.\nAn attacker can exploit this by intentionally crafting malformed or specific CCW chain inputs that trigger a failure in cp_init() after multiple segments have been successfully allocated. By repeatedly sending these malicious inputs, an attacker can exhaust kernel memory, eventually leading to system instability, kernel panics, or a total loss of availability for the affected s390 guest or host system.\nThe exploitation flow is as follows: 1) The attacker initiates an I/O operation using the vfio_ccw interface; 2) The driver begins processing the CCW chain and allocates memory for multiple segments; 3) A specific error condition is triggered (e.g., an invalid TIC or channel command sequence); 4) The failure path is executed, but the driver only frees the current, partially initialized segment; 5) The previously allocated segments remain in kernel memory. Since the driver has no reference to these leaked segments, they cannot be reclaimed until the system reboots, eventually resulting in memory pressure.\nThe vulnerability affects the core logic within the s390/vfio_ccw component responsible for managing translated channel programs."
}