CVE-2026-80710 is a vulnerability in Linux Kernel
Published on August 28, 2026
s390/dasd: Fix undersized format-check buffer
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix undersized format-check buffer
fmt_buffer_size in dasd_eckd_check_device_format() is declared as
int, even though one of the multiplicands, sizeof(struct eckd_count),
is a size_t. The expression
trkcount * rpt_max * sizeof(struct eckd_count)
is therefore correctly evaluated at 64-bit width, but the result is
silently truncated when it is stored back into the 32-bit
fmt_buffer_size variable. For a sufficiently large track range
(start_unit/stop_unit are caller-controlled) this truncation
yields a buffer size far smaller than the number of tracks actually
requested. kzalloc() then succeeds with an undersized allocation,
while the subsequent channel program build still operates on the
untruncated track count and writes past the end of that buffer.
Compute the buffer size with check_mul_overflow() and keep it in a
size_t, so that a value that no longer fits results in -EINVAL
instead of a silently truncated allocation size.
Products Associated with CVE-2026-80710
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8fd575200db5b53f6ea6818dd017f1b43190db12 and below aca18289c86f22d3fc2f3f6ff615286e7b1702f6 is affected.
- Version 8fd575200db5b53f6ea6818dd017f1b43190db12 and below 9f88dda2f22927d22498801a92cab6a9424eaf86 is affected.
- Version 8fd575200db5b53f6ea6818dd017f1b43190db12 and below e16e0fc54120cee3c6f0362de95aab6792865857 is affected.
- Version 8fd575200db5b53f6ea6818dd017f1b43190db12 and below 87f3389cd3920714c53e704778f7ca7f1cf0c39c is affected.
- Version 8fd575200db5b53f6ea6818dd017f1b43190db12 and below 7f40b346462f563a0d6e841a77b5163d2a882a04 is affected.
- Version 4.7 is affected.
- Before 4.7 is unaffected.
- Version 6.6.151, <= 6.6.* is unaffected.
- Version 6.12.103, <= 6.12.* is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.