High 8.8Published Aug 26, 2026

CVE-2026-80547s390/vfio_ccw: Implement a crw lock

Updated under an hour ago (Oct 28, 2026, 7:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	3f02cb2fd9d2d9e8762102886e3e4b51285797ee builds before 3c94d4179bcc19e01b28db634c07a58b28116209; 3f02cb2fd9d2d9e8762102886e3e4b51285797ee builds before 0edd222730a9d7ec98368aaf1d40ee2d8d862e61; from 3f02cb2fd9d2d9e8762102886e3e4b51285797ee before a3d60ae24183eee352c8e87a0ff94c97cd87f156; from 3f02cb2fd9d2d9e8762102886e3e4b51285797ee before 49fa26b0df009dc1f420980bd71780e70615b83b; from 3f02cb2fd9d2d9e8762102886e3e4b51285797ee before 7902be374cbfc11c3435e1e87bf22195bf06a558; from 3f02cb2fd9d2d9e8762102886e3e4b51285797ee before c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9; from 3f02cb2fd9d2d9e8762102886e3e4b51285797ee before 16b0798024c0e9117e395829ddbbe70981c79d9c	CNA record

References

References

https://git.kernel.org/stable/c/3c94d4179bcc19e01b28db634c07a58b28116209
https://git.kernel.org/stable/c/0edd222730a9d7ec98368aaf1d40ee2d8d862e61
https://git.kernel.org/stable/c/a3d60ae24183eee352c8e87a0ff94c97cd87f156
https://git.kernel.org/stable/c/49fa26b0df009dc1f420980bd71780e70615b83b
https://git.kernel.org/stable/c/7902be374cbfc11c3435e1e87bf22195bf06a558
https://git.kernel.org/stable/c/c76c4ee72bfc3824f4f491f18ed0323bf2e2daf9
https://git.kernel.org/stable/c/16b0798024c0e9117e395829ddbbe70981c79d9c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.