---
id: CVE-2026-80551
title: 's390/vfio_ccw: Ensure first IDAW remains constant'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/vfio_ccw: Ensure first IDAW remains constant

  The first IDAW in a list does not need to be on a 2K/4K boundary
  like all others, and so is read separately to accura…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b <
    460b977a4e71cc319fdadf91c193ec3beaa57263
  - >-
    Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b <
    0d46c2565f173bcddcdcaf44a4f69789a20535e2
  - >-
    Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b <
    08ef2a82115690d6e229615872ac1731af732497
  - >-
    Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b <
    fc59e9482117ebdccd6dc7fa8082f8b980fd021e
  - >-
    Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b <
    565bef268d75bf7df665bce6923a88cd0eb74592
  - Linux 5.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:17:11.083121Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:26.322Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80551'
references:
  - url: 'https://git.kernel.org/stable/c/460b977a4e71cc319fdadf91c193ec3beaa57263'
  - url: 'https://git.kernel.org/stable/c/0d46c2565f173bcddcdcaf44a4f69789a20535e2'
  - url: 'https://git.kernel.org/stable/c/08ef2a82115690d6e229615872ac1731af732497'
  - url: 'https://git.kernel.org/stable/c/fc59e9482117ebdccd6dc7fa8082f8b980fd021e'
  - url: 'https://git.kernel.org/stable/c/565bef268d75bf7df665bce6923a88cd0eb74592'
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.08643
ingestedAt: '2026-10-16T19:46:24.317Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio_ccw: Ensure first IDAW remains constant

The first IDAW in a list does not need to be on a 2K/4K boundary
like all others, and so is read separately to accurately calculate
the size of the buffer needed to read the full IDAL.

Verify that the address found in the first IDAW is unchanged between
reads, to ensure a consistent set of IDAWs being worked with.

## Affected

- `Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 460b977a4e71cc319fdadf91c193ec3beaa57263`
- `Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 0d46c2565f173bcddcdcaf44a4f69789a20535e2`
- `Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 08ef2a82115690d6e229615872ac1731af732497`
- `Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b < fc59e9482117ebdccd6dc7fa8082f8b980fd021e`
- `Linux >= 01aa26c672c0eb771de4aaa2a8ccf6055778887b < 565bef268d75bf7df665bce6923a88cd0eb74592`
- `Linux 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.