{"id":"CVE-2026-80584","revision":"72fc7e1fcea545ec9147e47f662ef44d","records":[{"revision":"72fc7e1fcea545ec9147e47f662ef44d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80584","aliases":[],"title":"s390/qeth: validate user buffer length in SNMP and ARP query ioctls","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: validate user buffer length in SNMP and ARP query ioctls\n\nqeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by\na user-supplied length (udata_len) without checking a lower bound, then\nset udata_offset to a fixed non-zero value and pass both to a reply\ncallback. The callback bounds-checks the copy with\n\n        if ((udata_len - udata_offset) < len)\n\nBoth fields are u32, so a udata_len smaller than udata_offset makes the\nsubtraction wrap and the check pass, and the following memcpy() writes\npast the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from\nkzalloc(), which the existing NULL check does not catch.\n\nReject buffers smaller than udata_offset before allocating, so the\ncallback subtraction can no longer underflow.","state":0,"publishedAt":"2026-08-26T14:37:40.302+00:00","modifiedAt":"2026-10-16T19:26:28.329+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/s390/net/qeth_core_main.c\",\n                        \"drivers/s390/net/qeth_l3_main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"9d00eeb2d27f4cc817c5e408760226d43f811ec6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"46443eaddebd84c51940857b11787229be169dec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"91935843f9396a9e45253e2c0d4337ca1371754b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"cc423f4105fe145b33e1d7cad34245a798358f73\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"3083818e67bcd656965797fbac9a3d6c1d44f78a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"a3083647747942ea32faf14560d6397ff3068046\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"75fb3151513d7d9f77a8f9545418279b119c06b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a71df50047f0db65ea09b1be155852e81a45eba\",\n                            \"lessThan\": \"d141f087b1af656f055d7c5793a3e87817ba0bbe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/s390/net/qeth_core_main.c\",\n                        \"drivers/s390/net/qeth_l3_main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.26\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.26\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.266\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.217\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.184\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.153\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.105\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.46\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.10\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/9d00eeb2d27f4cc817c5e408760226d43f811ec6","https://git.kernel.org/stable/c/46443eaddebd84c51940857b11787229be169dec","https://git.kernel.org/stable/c/91935843f9396a9e45253e2c0d4337ca1371754b","https://git.kernel.org/stable/c/cc423f4105fe145b33e1d7cad34245a798358f73","https://git.kernel.org/stable/c/3083818e67bcd656965797fbac9a3d6c1d44f78a","https://git.kernel.org/stable/c/a3083647747942ea32faf14560d6397ff3068046","https://git.kernel.org/stable/c/75fb3151513d7d9f77a8f9545418279b119c06b8","https://git.kernel.org/stable/c/d141f087b1af656f055d7c5793a3e87817ba0bbe"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80584","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80584","identifiers":["CVE-2026-80584"]},"retained":false,"historicalAffected":[]}],"coverage":[]}