s390/qeth: validate user buffer length in SNMP and ARP query ioctls

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80584
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-26 15:17:14 UTC
Updated2026-08-27 06:17:45 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with if ((udata_len - udata_offset) < len) Both fields are u32, so a udata_len smaller than udata_offset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from kzalloc(), which the existing NULL check does not catch. Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow.

Risk And Classification

Primary CVSS: v3.1 8.4 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001340000 probability, percentile 0.031800000 (date 2026-08-27)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba 9d00eeb2d27f4cc817c5e408760226d43f811ec6 git Not specified
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba 46443eaddebd84c51940857b11787229be169dec git Not specified
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba 91935843f9396a9e45253e2c0d4337ca1371754b git Not specified
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba cc423f4105fe145b33e1d7cad34245a798358f73 git Not specified
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba 3083818e67bcd656965797fbac9a3d6c1d44f78a git Not specified
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba a3083647747942ea32faf14560d6397ff3068046 git Not specified
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba 75fb3151513d7d9f77a8f9545418279b119c06b8 git Not specified
CNA Linux Linux affected 4a71df50047f0db65ea09b1be155852e81a45eba d141f087b1af656f055d7c5793a3e87817ba0bbe git Not specified
CNA Linux Linux affected 2.6.26 Not specified
CNA Linux Linux unaffected 2.6.26 semver Not specified
CNA Linux Linux unaffected 5.10.266 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.217 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.184 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.153 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.105 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.46 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.10 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/a3083647747942ea32faf14560d6397ff3068046 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/75fb3151513d7d9f77a8f9545418279b119c06b8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/91935843f9396a9e45253e2c0d4337ca1371754b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d141f087b1af656f055d7c5793a3e87817ba0bbe 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cc423f4105fe145b33e1d7cad34245a798358f73 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3083818e67bcd656965797fbac9a3d6c1d44f78a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9d00eeb2d27f4cc817c5e408760226d43f811ec6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/46443eaddebd84c51940857b11787229be169dec 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report