CVE-2026-80710

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the s390/dasd component where the fmt buffer size variable in the dasd eckd check device format() function is declared as an int. When calculating the buffer size using the expression trkcount * rpt max * sizeof(struct eckd count), the result is evaluated at 64-bit width but truncated when stored in the 32-bit fmt buffer size variable. If a caller provides a sufficiently large track range via start unit and stop unit, this truncation leads to an undersized memory allocation via kzalloc(). Consequently, the subsequent channel program build uses the original untruncated track count, resulting in a write operation past the end of the allocated buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.