s390/vfio_ccw: Ensure first IDAW remains constant (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 9 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with.
References
- https://git.kernel.org/stable/c/5b7c23440343e336259cd45017cc901a744c41b0
- https://git.kernel.org/stable/c/460b977a4e71cc319fdadf91c193ec3beaa57263
- https://git.kernel.org/stable/c/0d46c2565f173bcddcdcaf44a4f69789a20535e2
- https://git.kernel.org/stable/c/08ef2a82115690d6e229615872ac1731af732497
- https://git.kernel.org/stable/c/fc59e9482117ebdccd6dc7fa8082f8b980fd021e
- https://git.kernel.org/stable/c/565bef268d75bf7df665bce6923a88cd0eb74592
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | Linux |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-66466
- GCVE · GCVE-0-2026-80551
CERT-FR advisories
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1232 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 5b7c23440343e336259cd45017cc901a744c41b0 ; affected 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 460b977a4e71cc319fdadf91c193ec3beaa57263 ; affected 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 0d46c2565f173bcddcdcaf44a4f69789a20535e2 ; affected 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 08ef2a82115690d6e229615872ac1731af732497 ; affected 01aa26c672c0eb771de4aaa2a8ccf6055778887b < fc59e9482117ebdccd6dc7fa8082f8b980fd021e ; affected 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 565bef268d75bf7df665bce6923a88cd0eb74592 |
| Linux · Linux | affected 5.3 ; unaffected 0 < 5.3 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.154 ≤ 6.6.* ; unaffected 6.12.105 ≤ 6.12.* ; unaffected 6.18.46 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |