CVE-2026-80584
Received Received - Intake

Buffer Length Validation Flaw in Linux Kernel s390/qeth

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with if ((udata_len - udata_offset) < len) Both fields are u32, so a udata_len smaller than udata_offset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from kzalloc(), which the existing NULL check does not catch. Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80584
EUVD
EUVD-2026-66499

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of user buffer lengths in SNMP and ARP query ioctls. Functions qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer based on a user-supplied length without checking a minimum size. They then set a fixed offset and pass both values to a reply callback that performs a bounds check. Due to potential integer underflow, a small user-supplied length can bypass the check, leading to a memcpy() writing past the allocated buffer.

Detection Guidance

This vulnerability affects the Linux kernel's s390/qeth driver, specifically in SNMP and ARP query ioctls. Detection requires checking for kernel versions with the vulnerable code and monitoring for unusual memory access patterns or crashes in qeth-related processes.

Impact Analysis

This vulnerability could allow local users to cause a denial of service or execute arbitrary code by triggering a buffer overflow. Successful exploitation may lead to system crashes, data corruption, or unauthorized access, depending on the kernel's memory layout and protections.

Mitigation Strategies

Apply the latest kernel patches that address this issue. If patches are unavailable, disable the qeth driver or restrict access to SNMP and ARP query ioctls until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart