CVE-2026-80710 Overview
CVE-2026-80710 is a Linux kernel vulnerability in the s390 DASD (Direct Access Storage Device) ECKD driver. The fmt_buffer_size variable in dasd_eckd_check_device_format() is declared as int, causing a 64-bit multiplication result to be silently truncated when assigned back. When a caller supplies a sufficiently large track range through start_unit/stop_unit, the truncation produces an allocation far smaller than required. kzalloc() succeeds with the undersized buffer, and the subsequent channel program build writes past the buffer end using the untruncated track count.
Critical Impact
A local user with access to the DASD format-check code path on s390 systems can trigger a heap out-of-bounds write, leading to kernel memory corruption, denial of service, or potential privilege escalation.
Affected Products
- Linux kernel s390 architecture builds with the DASD ECKD driver enabled
- Systems running IBM Z / LinuxONE where DASD storage is exposed to local users
- Kernel branches prior to the fixes referenced by commits 7f40b34, 87f3389, 9f88dda, aca1828, and e16e0fc
Discovery Timeline
- 2026-08-28 - CVE-2026-80710 published to the National Vulnerability Database
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80710
Vulnerability Analysis
The defect lives in the s390 DASD ECKD driver function dasd_eckd_check_device_format(). This routine validates the on-disk format of tracks in a caller-specified range. To do so, it allocates a buffer sized proportionally to the number of tracks and the maximum records per track.
The allocation size is computed as trkcount * rpt_max * sizeof(struct eckd_count). Because sizeof(struct eckd_count) is a size_t, the expression is evaluated at 64-bit width. However, the result is stored in fmt_buffer_size, which is declared as int. Any value exceeding INT_MAX is silently truncated to 32 bits.
After truncation, kzalloc() allocates a buffer matching the truncated size. The channel program construction that follows still iterates using the original 64-bit track count, so it writes records beyond the end of the allocation. This is a classic integer truncation flaw leading to a heap out-of-bounds write [CWE-190, CWE-787].
Root Cause
The root cause is a numeric truncation error. Mixing a signed 32-bit int destination with a 64-bit multiplication chain allows large but valid input ranges to wrap to small positive values. The allocation logic and the consuming code operate on inconsistent size representations.
Attack Vector
Exploitation requires local access with the ability to invoke the DASD format-check ioctl path where start_unit and stop_unit are caller-controlled. An attacker chooses a track range large enough that the buffer-size expression exceeds INT_MAX when multiplied by sizeof(struct eckd_count) and rpt_max. The resulting undersized allocation is then overrun by the channel program builder.
The upstream fix replaces the multiplication with check_mul_overflow() and stores the result in a size_t, returning -EINVAL when the value no longer fits. See the kernel commit 7f40b34 and the kernel commit e16e0fc for the corrected implementation.
Detection Methods for CVE-2026-80710
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing dasd_eckd_check_device_format or nearby ECKD symbols
- KASAN slab-out-of-bounds reports naming kzalloc allocations from the DASD ECKD driver
- Local processes issuing unusual BIODASDCHECKFMT ioctl requests with very large track ranges
Detection Strategies
- Audit kernel logs (dmesg, journalctl -k) on s390 systems for DASD-related warnings, stack traces, or slab corruption reports
- Enable KASAN on test kernels to detect the out-of-bounds write during quality assurance runs
- Correlate DASD ioctl activity from unprivileged users with subsequent kernel error messages
Monitoring Recommendations
- Track kernel version and s390 patch level across the fleet to identify hosts still exposed to the unpatched code path
- Alert on repeated crashes of DASD-managing processes or on filesystem I/O errors on ECKD volumes
- Monitor for local user access to raw DASD device nodes and unusual format-check operations
How to Mitigate CVE-2026-80710
Immediate Actions Required
- Update to a Linux kernel version that includes the stable-tree fix referenced by commits 7f40b34, 87f3389, 9f88dda, aca1828, or e16e0fc
- Restrict local shell and ioctl access to DASD device nodes to trusted administrative accounts only
- Prioritize patching on s390/IBM Z hosts that expose DASD volumes to multi-tenant workloads
Patch Information
The upstream fix computes the buffer size with check_mul_overflow() and stores it in a size_t. When the multiplication would overflow the target type, the function returns -EINVAL instead of proceeding with a truncated allocation. Apply the vendor kernel update that incorporates any of the referenced stable commits: 7f40b34, 87f3389, 9f88dda, aca1828, and e16e0fc.
Workarounds
- Remove or tighten permissions on DASD device nodes so only privileged system components can invoke format-check operations
- If the ECKD driver is not required, unload or blacklist the dasd_eckd_mod module to eliminate the vulnerable code path
- Enforce SELinux or AppArmor policies that limit which processes can issue DASD management ioctls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
