CVE-2026-80550 (CVSS 7.9)

Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.

Is your site exposed to CVE-2026-80550?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.9

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

EPSS — Exploit Prediction

0.0014

Probability of exploitation

0.03%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0282fb1c4b638eecfe2cc558092c460911d8f7e2 https://git.kernel.org/stable/c/499a8a66b1598bfab97182aed15e0f1646074a3d https://git.kernel.org/stable/c/4c2e1d359d7a2b82cdf3254e4e480af9417f99fb https://git.kernel.org/stable/c/907adc667d902fafbdb2d740d57b55bd025dc4cd https://git.kernel.org/stable/c/a005b7f1a491ffda61bff0fd0f6548f8986fb977 https://git.kernel.org/stable/c/af3f80ca4c8b17f20f9e588def076288fdb49e65 https://git.kernel.org/stable/c/d5d096cd9369e986d4e5153baa86b8b35c283e09 https://git.kernel.org/stable/c/f20be33d093ce7630c17ff7ed93caf7eaf8ac1a3

Frequently Asked Questions

What is CVE-2026-80550? +

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa_within_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error. Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range. It has a CVSS v3.1 base score of 7.9 (HIGH).

How severe is CVE-2026-80550? +

CVE-2026-80550 has a CVSS v3.1 score of 7.9 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0014, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-80550? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-80550