CVE-2026-80584

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description An issue exists in the s390/qeth component where the qeth snmp command() and qeth l3 arp query() functions allocate a buffer based on a user-supplied length udata len without verifying a lower bound. Because udata len and udata offset are u32 types, providing a udata len smaller than udata offset causes an integer underflow during subtraction in the callback bounds-check. This allows a memcpy() operation to write past the allocated buffer, leading to a buffer overflow. Additionally, a udata len of 0 can result in a ZERO SIZE PTR from kzalloc(), which bypasses existing NULL checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.