SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-80555

HIGH · CVSS 7.1 EPSS 0.14%

Source: NVD + CISA KEV + EPSS · Published 2026-08-26 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability in the Linux kernel affects the s390 architecture, specifically within the vfio_ccw component, where memory allocated during I/O operations may not be properly freed if the initialization process fails. This can lead to memory leaks, potentially impacting system performance and stability. Organizations using Linux on s390 systems should prioritize addressing this issue to ensure efficient memory management and prevent resource exhaustion.

CVE
CVE-2026-80555
Severity
HIGH
CVSS
7.1
EPSS
0.14%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.