Executive brief
The Linux kernel's qeth network driver (used on IBM System z mainframe systems) has a buffer handling vulnerability in its SNMP and ARP query operations. An unprivileged local attacker can trigger a buffer overflow by passing a specially crafted request, leading to kernel memory corruption, system crash, or potential privilege escalation.
Technical details
The vulnerability exists in qeth_snmp_command() and qeth_l3_arp_query() functions which allocate a kernel buffer based on user-supplied length (udata_len) without validating a lower bound. These functions set a fixed udata_offset and pass both values to a reply callback that performs bounds-checking via integer subtraction: (udata_len - udata_offset) < len. Since both fields are u32, a udata_len smaller than udata_offset causes unsigned integer underflow, bypassing the bounds check and allowing memcpy() to write past the allocated buffer. Additionally, udata_len of 0 returns ZERO_SIZE_PTR from kzalloc() which existing NULL checks do not catch. The fix validates that udata_len meets minimum size requirements before allocation, preventing the underflow. This is a local privilege escalation vector requiring user access to invoke the affected ioctls.
Affected products
- Linux Linux kernel multiple kernel versions (affects qeth driver across 2.6.x through 6.x series)
Timeline
- 2026-08-26: disclosed: CVE-2026-80584 published on NVD
- 2026-08-23: patched: Fix committed upstream and backported to stable branches