CVE-2026-80555 (CVSS 7.1)

Description

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic.

Is your site exposed to CVE-2026-80555?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0014

Probability of exploitation

0.04%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/152fcb74a26804b70909381c6acc90595a0ae1c1 https://git.kernel.org/stable/c/17e01e342af74de12899c206dcc9ec90684703aa https://git.kernel.org/stable/c/276bd7ed34d56c48c65c43c0b08f2ee77029b2fa https://git.kernel.org/stable/c/32e3d364a7b8295120d37e6a6bd433d2de26f748 https://git.kernel.org/stable/c/4699b54fada156534cbb39834d47fc9374d7a1f5 https://git.kernel.org/stable/c/6a917199aaf97904f5619afe3dfdacb155b03e8c https://git.kernel.org/stable/c/74186c2968f8f756ac3226b545b598457c910c75 https://git.kernel.org/stable/c/f9bcff265556796834122f95de16d52a8375206c

Frequently Asked Questions

What is CVE-2026-80555? +

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccwchain_handle_ccw(), where a single call to ccwchain_free() is made for the currently-processed CCW segment. But this will leak other segments (created as a result of a Transfer in Channel) that had been allocated as part of the same channel program. Address this by performing the cleanup outside of the recursive ccwchain_handle_ccw()/ccwchain_loop_tic() logic. It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2026-80555? +

CVE-2026-80555 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0014, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-80555? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-80555