CVE-2026-80571: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80571 Overview

CVE-2026-80571 is a Linux kernel vulnerability in the powerpc/pseries subsystem, specifically within the papr_phy_attest_create_handle() function. The function fails to validate the params->cmd.length field before use, enabling a buffer overflow condition. The same code path also contains a memory leak because the params structure is freed only on the success path and not on error conditions or when a negative file descriptor is returned.

The issue affects PowerPC systems running under IBM pSeries logical partitions (LPARs) that expose the PAPR physical attestation interface to userspace.

Critical Impact
An unvalidated length field passed to a kernel handle-creation routine can trigger a buffer overflow, while parallel error paths leak kernel memory on repeated failed calls.

Affected Products

Linux kernel (mainline) — arch/powerpc/platforms/pseries PAPR physical attestation driver
Linux stable branches receiving the referenced backports
PowerPC pSeries (IBM Power) platforms exposing the papr-phy-attest character device

Discovery Timeline

2026-08-26 - CVE-2026-80571 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80571

Vulnerability Analysis

The defect resides in papr_phy_attest_create_handle(), which builds a kernel-side handle for PAPR physical attestation commands issued from userspace. The function accepts a params structure containing an embedded cmd buffer and a cmd.length field describing how many bytes of that buffer are valid.

The original implementation used cmd.length without bounding it against sizeof(params->cmd). When cmd.length exceeded the destination buffer size, subsequent copy operations wrote past the end of the buffer, producing a kernel-space buffer overflow [CWE-120]. A cmd.length value of 0 was likewise not rejected, creating an additional degenerate input path.

A second defect existed in resource management. The params allocation was released on the success path, but error branches after allocation and the negative file-descriptor branch returned without freeing it. Repeated failing calls therefore leaked kernel memory [CWE-401].

Root Cause

The root cause is missing input validation on an attacker-controlled length field, combined with asymmetric cleanup between success and failure paths. The fix adds an explicit check that returns -EINVAL when cmd.length is 0 or greater than sizeof(params->cmd), and moves the kfree(params) call so that it also runs on the error and negative-fd paths.

Attack Vector

Exploitation requires local access to a PowerPC pSeries system with the papr-phy-attest interface exposed to a caller that can issue the create-handle ioctl. A local user with access to the device can supply a crafted params structure to trigger either the overflow or, by repeatedly forcing the error path, the memory leak.

Because no verified public exploit code is available, refer to the upstream fix commits for the precise instruction sequence:

Detection Methods for CVE-2026-80571

Indicators of Compromise

Unexpected kernel oops or stack traces referencing papr_phy_attest_create_handle in dmesg or /var/log/messages.
Steady growth in kernel slab allocations attributable to the pseries attestation driver without a matching workload increase.
Unprivileged processes on pSeries LPARs repeatedly opening /dev/papr-phy-attest and issuing ioctls with malformed length fields.

Detection Strategies

Audit running kernels on Power hardware to confirm the fix commits are present, using uname -r and distribution changelog checks against the referenced stable commits.
Enable KASAN or KFENCE in test kernels to surface any out-of-bounds writes originating from the PAPR attestation path during fuzzing.
Monitor /proc/slabinfo and kmemleak reports for growth patterns consistent with the leaked params allocation.

Monitoring Recommendations

Forward kernel logs from Power LPARs into a centralized analytics tier and alert on panics or WARN entries mentioning papr_phy_attest.
Track ioctl activity against /dev/papr-phy-attest and correlate high-frequency failures with the invoking UID.
Baseline slab and page allocation trends per host so that leaks driven by repeated failed ioctls become visible against normal workload variance.

How to Mitigate CVE-2026-80571

Immediate Actions Required

Apply a kernel update that includes commits 5b17f3f, 828a8d1, and ed98ce3 on all PowerPC pSeries systems.
Restrict access to the papr-phy-attest character device to trusted administrative accounts using file permissions and Mandatory Access Control policy.
Inventory Power LPARs to identify hosts running unpatched stable branches and prioritize them for reboot into fixed kernels.

Patch Information

The upstream fix validates cmd.length and returns -EINVAL when it is 0 or exceeds sizeof(params->cmd). It also ensures params is freed on error paths after allocation and on the negative file-descriptor path. Backports are tracked in Kernel Git Commit 5b17f3f, Kernel Git Commit 828a8d1, and Kernel Git Commit ed98ce3.

Workarounds

Remove or restrict permissions on /dev/papr-phy-attest so only root can open it until a fixed kernel is deployed.
Disable or unload the PAPR physical attestation module on systems that do not require attested platform measurements.
Constrain untrusted workloads on affected LPARs using seccomp or container policies that block ioctls against the attestation device.

bash

# Restrict access to the papr-phy-attest device pending patch deployment
chown root:root /dev/papr-phy-attest
chmod 0600 /dev/papr-phy-attest

# Verify the running kernel includes one of the fix commits
zcat /proc/config.gz | grep -i pseries
dmesg | grep -i papr_phy_attest