CVE-2026-80554Critical· 9.3▾ Midnight

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arb…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score51/ 100 · Moderate

impact 51.2 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 26, 2026

Updated

Oct 16, 2026

CVSS

9.3

Vendor

Red Hat

Product

Red Hat Enterprise Linux 9

CWE

CWE-770

Depth score

51 · Moderate

EPSS

0.20% · p9

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scores by source

NVD 9.3 · CNA 9.3 · Vendor 5.5⚖ 3.8-point dispute

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 63 days

Aug 26, 2026Published
Disclosed via NVD
Oct 16, 2026Record revised
Last analysed / modified upstream
Oct 16, 2026EPSS first tracked
0.2%
Oct 18, 2026CVSS changed
9.3 → 5.5
Oct 18, 2026Severity changed
critical → medium
Oct 27, 2026CVSS changed
5.5 → 9.3
Oct 27, 2026Severity changed
medium → critical

Red Hat CWE-770 #nvd #csaf #vex #red-hat #cve.org #score-dispute

Affected

enterprise_linux 10
enterprise_linux 9

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Limit the number of channel program segments

The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program.

The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Vendor advisories

Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-18 · vex

References

Change history

Field changes observed since this record was first indexed.

Oct 27, 2026CVSS 5.5 → 9.3
Oct 27, 2026Severity medium → critical
Oct 18, 2026CVSS 9.3 → 5.5
Oct 18, 2026Severity critical → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#csaf#vex#red-hat#cve.org#score-dispute

← Back to feed