Linux Kernel Vulnerability in VFIO CCW Affecting Multiple Versions

CVE-2026-80554

What is CVE-2026-80554?

A flaw in the Linux kernel's handling of VFIO CCW can lead to an improper input validation issue due to recursive processing methods of channel programs. The vulnerability arises when the system encounters Transfer-In-Channel (TIC) CCWs, which could theoretically lead to an indefinite increase in the number of segments per channel program. Limitations imposed on the global count of segments ensure that this recursion does not compromise system stability until a thorough redesign can be achieved.

References