High 7.1Published Aug 26, 2026

CVE-2026-80555s390/vfio_ccw: Free all memory if cp_init() fails

Updated under an hour ago (Oct 27, 2026, 1:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 276bd7ed34d56c48c65c43c0b08f2ee77029b2fa; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before f9bcff265556796834122f95de16d52a8375206c; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 17e01e342af74de12899c206dcc9ec90684703aa; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 152fcb74a26804b70909381c6acc90595a0ae1c1; 8b515be512a2435bb8aedc6390cbe140167f9eb9 builds before 6a917199aaf97904f5619afe3dfdacb155b03e8c; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 32e3d364a7b8295120d37e6a6bd433d2de26f748; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 4699b54fada156534cbb39834d47fc9374d7a1f5; from 8b515be512a2435bb8aedc6390cbe140167f9eb9 before 74186c2968f8f756ac3226b545b598457c910c75	CNA record

References

References

https://git.kernel.org/stable/c/276bd7ed34d56c48c65c43c0b08f2ee77029b2fa
https://git.kernel.org/stable/c/f9bcff265556796834122f95de16d52a8375206c
https://git.kernel.org/stable/c/17e01e342af74de12899c206dcc9ec90684703aa
https://git.kernel.org/stable/c/152fcb74a26804b70909381c6acc90595a0ae1c1
https://git.kernel.org/stable/c/6a917199aaf97904f5619afe3dfdacb155b03e8c
https://git.kernel.org/stable/c/32e3d364a7b8295120d37e6a6bd433d2de26f748
https://git.kernel.org/stable/c/4699b54fada156534cbb39834d47fc9374d7a1f5
https://git.kernel.org/stable/c/74186c2968f8f756ac3226b545b598457c910c75

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.