CVE-2026-80584: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80584 Overview

CVE-2026-80584 is a heap buffer overflow in the Linux kernel's s390/qeth network driver. The functions qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without enforcing a lower bound. A reply callback then computes udata_len - udata_offset as a u32 subtraction. When udata_len is smaller than the fixed udata_offset, the subtraction underflows, the bounds check passes, and the subsequent memcpy() writes past the allocation. A udata_len of 0 additionally causes kzalloc() to return ZERO_SIZE_PTR, bypassing the existing NULL check.

Critical Impact
A local user with access to the qeth ioctl interface on IBM Z (s390) systems can trigger an out-of-bounds heap write, potentially leading to kernel memory corruption and privilege escalation.

Affected Products

Linux kernel s390/qeth driver (multiple stable branches, per referenced git commits)
IBM Z (s390) systems using OSA/HiperSockets networking via the qeth driver
Distributions shipping the affected kernel on s390x architecture

Discovery Timeline

2026-08-26 - CVE-2026-80584 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80584

Vulnerability Analysis

The vulnerability is an integer underflow leading to an out-of-bounds heap write [CWE-124/CWE-191] in the s390 qeth driver. Two ioctl paths, qeth_snmp_command() and qeth_l3_arp_query(), accept a user-supplied udata_len value and allocate a kernel buffer of that size using kzalloc(). Both functions then set udata_offset to a fixed non-zero value and forward both fields to a reply callback.

The callback validates the copy with if ((udata_len - udata_offset) < len). Because both operands are u32, supplying a udata_len smaller than udata_offset causes the subtraction to wrap into a very large unsigned value. The check then trivially succeeds, and the following memcpy() writes device-controlled data past the allocated buffer.

Root Cause

The root cause is missing lower-bound validation of the user-supplied udata_len prior to allocation and prior to arithmetic against udata_offset. A secondary defect is that kzalloc(0, ...) returns ZERO_SIZE_PTR rather than NULL, which the existing NULL check does not detect. The upstream fix rejects buffers smaller than udata_offset before allocation, eliminating both the underflow and the zero-length allocation path.

Attack Vector

Exploitation requires local access on an s390 system with the qeth driver loaded and an accessible network interface. The attacker issues a crafted SIOCETHTOOL-style ioctl with a udata_len value below the driver's fixed udata_offset. The subsequent reply-processing path performs the underflowing subtraction and copies attacker-influenced bytes past a heap allocation. Successful exploitation yields kernel heap corruption suitable for privilege escalation, denial of service, or information disclosure.

No verified public exploit code is available. See the referenced kernel.org commit cc423f41 for the authoritative patch describing the vulnerable arithmetic and its correction.

Detection Methods for CVE-2026-80584

Indicators of Compromise

Unexpected kernel oops, slab corruption warnings, or KASAN out-of-bounds reports referencing qeth_snmp_command, qeth_l3_arp_query, or qeth_send_ipa_cmd on s390x hosts.
Local processes issuing qeth-specific ioctls with abnormally small udata_len values against qeth network interfaces.
Kernel panics or unexpected reboots on IBM Z guests shortly after userland interaction with qeth network devices.

Detection Strategies

Enable KASAN or SLUB debug on non-production s390x kernels to surface out-of-bounds writes originating in the qeth driver.
Audit ioctl(2) syscalls targeting qeth interfaces via eBPF or auditd, alerting on non-root callers or unusually small user buffer lengths.
Correlate kernel ring buffer messages (dmesg) mentioning qeth with process execution telemetry to identify suspicious local activity.

Monitoring Recommendations

Ship s390x kernel logs to a centralized logging platform and alert on stack traces containing qeth_snmp_command or qeth_l3_arp_query.
Track kernel package versions across the IBM Z fleet to identify hosts still running pre-patch builds.
Baseline which users and services legitimately issue qeth ioctls, and alert on deviations.

How to Mitigate CVE-2026-80584

Immediate Actions Required

Apply the vendor kernel update containing the qeth udata_len validation fix to all s390x hosts.
Restrict local shell and container access on IBM Z systems to trusted administrators until patches are deployed.
Review which processes require access to qeth network device ioctls and remove unnecessary privileges.

Patch Information

The upstream fix rejects buffers smaller than udata_offset before allocation, preventing both the u32 subtraction underflow and the ZERO_SIZE_PTR allocation. The change is backported across multiple stable branches. Relevant kernel.org commits include 3083818e, 46443ead, 75fb3151, 91935843, 9d00eeb2, a3083647, cc423f41, and d141f087. Consult your distribution's security tracker for the corresponding backported package version.

Workarounds

If patching is delayed, blacklist the qeth module on systems that do not require IBM Z OSA/HiperSockets networking.
Limit access to network configuration ioctls by removing CAP_NET_ADMIN from unprivileged users and containers.
Deny local logon on production s390x LPARs and z/VM guests to reduce the population able to reach the vulnerable ioctl paths.

bash

# Verify kernel version on affected s390x hosts and confirm patch level
uname -a
rpm -q kernel   # or: dpkg -l | grep linux-image

# Optional: prevent the qeth module from loading if not required
echo 'install qeth /bin/true' | sudo tee /etc/modprobe.d/disable-qeth.conf