Executive brief
The Linux kernel's PowerPC pseries physical-attestation driver contains a buffer overflow vulnerability in the papr_phy_attest_create_handle() function that processes user-provided command parameters. An attacker with local access could craft a malicious command with an invalid length field to trigger a buffer overflow or denial of service. Additionally, the function fails to free allocated memory in certain error paths, creating memory leaks.
Technical details
The vulnerability is a buffer overflow in the papr-phy-attest.c driver's papr_phy_attest_create_handle() function. The root cause is insufficient validation of the params->cmd.length field before use, which can exceed the allocated buffer size (sizeof(params->cmd)). The function also has memory management issues, failing to free the params pointer on multiple error paths. An attacker must have local kernel interface access to exploit this; the fix validates cmd.length is non-zero and does not exceed the buffer size, and adds kfree() calls in all error paths including when the file descriptor creation fails. The patch was merged on 2026-08-08 for Linux 6.16 and later.
Affected products
- Linux Linux kernel prior to 6.16; stable kernels backporting commit 5b17f3f34391372faf03e79d947e0c50ab6dd258
Timeline
- 2026-08-26: disclosed: CVE-2026-80571 published on NVD
- 2026-08-08: patched: Fix merged upstream (commit 5b17f3f34391372faf03e79d947e0c50ab6dd258)
- 2026-08-23: other: Backported to stable kernels (commit 828a8d1a9107aec6353d896882df8383accf7e80)