CVE-2022-50307: s390/cio: fix out-of-bounds access on cio_ignore free

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-15 · updated 2026-06-17
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix out-of-bounds access on cio_ignore free The channel-subsystem-driver scans for newly available devices whenever device-IDs are removed from the cio_ignore list using a command such as: echo free >/proc/cio_ignore Since an I/O device scan might interfer with running I/Os, commit 172da89ed0ea ("s390/cio: avoid excessive path-verification requests") introduced an optimization to exclude online devices from the scan. The newly added check for online devices incorrectly assumes that an I/O-subchannel's drvdata points to a struct io_subchannel_private. For devices that are bound to a non-default I/O subchannel driver, such as the vfio_ccw driver, this results in an out-of-bounds read access during each scan. Fix this by changing the scan logic to rely on a driver-independent online indication. For this we can use struct subchannel->config.ena, which is the driver's requested subchannel-enabled state. Since I/Os can only be started on enabled subchannels, this matches the intent of the original optimization of not scanning devices where I/O might be running.

Affected products

Linux kernel: from 5.15.1 before 5.15.78; from 5.16 before 6.0.7; 5.15, 5.15-rc4, 5.15-rc5, 5.15-rc6, 5.15-rc7, 6.1-rc1 (+1) — fixed in 5.15.78, 6.0.7

How to fix

Upgrade to a fixed version: Linux kernel 5.15.78, 6.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-50307 or the next vulnerability affects your stack