Executive brief
The Linux kernel's DASD storage driver on IBM System z architecture contains an integer overflow vulnerability in the format-check buffer allocation routine. When processing format check requests with large track ranges, a buffer is allocated with an incorrect (truncated) size, but the code still writes the full amount of data, causing a heap buffer overflow. An attacker with local access to perform raw storage I/O operations could trigger this vulnerability to corrupt kernel memory or execute arbitrary code.
Technical details
The vulnerability is an integer truncation flaw in dasd_eckd_check_device_format() where fmt_buffer_size is declared as a 32-bit int, but the calculation trkcount * rpt_max * sizeof(struct eckd_count) involves a size_t operand. The result is evaluated at 64-bit width but silently truncated when stored to the 32-bit variable. For sufficiently large track ranges (controllable via start_unit/stop_unit parameters), this causes kzalloc() to allocate an undersized buffer, while subsequent channel program construction uses the untruncated count and writes past the buffer boundary. The fix changes fmt_buffer_size to size_t and adds explicit overflow checking using check_mul_overflow() to return -EINVAL instead of proceeding with a truncated size. The vulnerability affects Linux kernel versions 4.7 and later.
Affected products
- Linux Linux kernel 4.7 and later
Timeline
- 2026-08-28: disclosed
- 2026-07-31: patched