CVE-2026-80584

In the Linux kernel, the following vulnerability has been resolved:

s390/qeth: validate user buffer length in SNMP and ARP query ioctls

qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by

a user-supplied length (udata_len) without checking a lower bound, then

set udata_offset to a fixed non-zero value and pass both to a reply

callback. The callback bounds-checks the copy with

if ((udata_len - udata_offset) < len)

Both fields are u32, so a udata_len smaller than udata_offset makes the

subtraction wrap and the check pass, and the following memcpy() writes

past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from

kzalloc(), which the existing NULL check does not catch.

Reject buffers smaller than udata_offset before allocating, so the

callback subtraction can no longer underflow.