CVE-2026-80584s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with if ((udata_len - udata_offset) < len) Both fields are u32, so a udata_len smaller than udata_offset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from kzalloc(), which the existing NULL check does not catch. Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4a71df50047f0db65ea09b1be155852e81a45eba before 9d00eeb2d27f4cc817c5e408760226d43f811ec6; from 4a71df50047f0db65ea09b1be155852e81a45eba before 46443eaddebd84c51940857b11787229be169dec; from 4a71df50047f0db65ea09b1be155852e81a45eba before 91935843f9396a9e45253e2c0d4337ca1371754b; from 4a71df50047f0db65ea09b1be155852e81a45eba before cc423f4105fe145b33e1d7cad34245a798358f73; from 4a71df50047f0db65ea09b1be155852e81a45eba before 3083818e67bcd656965797fbac9a3d6c1d44f78a; from 4a71df50047f0db65ea09b1be155852e81a45eba before a3083647747942ea32faf14560d6397ff3068046; from 4a71df50047f0db65ea09b1be155852e81a45eba before 75fb3151513d7d9f77a8f9545418279b119c06b8; from 4a71df50047f0db65ea09b1be155852e81a45eba before d141f087b1af656f055d7c5793a3e87817ba0bbe | CNA record |
References
- https://git.kernel.org/stable/c/9d00eeb2d27f4cc817c5e408760226d43f811ec6
- https://git.kernel.org/stable/c/46443eaddebd84c51940857b11787229be169dec
- https://git.kernel.org/stable/c/91935843f9396a9e45253e2c0d4337ca1371754b
- https://git.kernel.org/stable/c/cc423f4105fe145b33e1d7cad34245a798358f73
- https://git.kernel.org/stable/c/3083818e67bcd656965797fbac9a3d6c1d44f78a
- https://git.kernel.org/stable/c/a3083647747942ea32faf14560d6397ff3068046
- https://git.kernel.org/stable/c/75fb3151513d7d9f77a8f9545418279b119c06b8
- https://git.kernel.org/stable/c/d141f087b1af656f055d7c5793a3e87817ba0bbe
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.