AZL-97713
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97713.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-97713
- Upstream
- Published
- 2026-08-26T15:17:09Z
- Modified
- 2026-08-29T05:27:27Z
- Summary
- CVE-2026-80550 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Fix out of bounds check on CCW array
The routine ccwchaincalclength() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAINLENMAX (256) CCWs.
The loop itself is "do..while (count < 257)", and while the logic in iscpawithin_range() correctly adjusts between the 0-index array of CCWs and the count of CCWs starting at 1, this means it would look at a possible 257th CCW before ending the loop and (correctly) returning an error.
Fix this by restructuring the loop to break as soon as 256 CCWs (thus indexes 0-255) are examined, without looking at memory outside the range.
- References