Buffer Size Issue in Linux Kernel's s390/dasd Component

CVE-2026-80710

What is CVE-2026-80710?

In the Linux kernel's s390/dasd component, an issue was identified in the fmt_buffer_size variable, which was declared as an int. This led to a risk where it could not accommodate larger calculations. Specifically, the trkcount multiplied by rpt_max and the size of struct eckd_count could produce a size that exceeded the limits of a 32-bit integer. Consequently, this resulted in a buffer that was smaller than needed, allowing kzalloc() to allocate insufficient space. As a result, operations following the allocation could exceed the buffer, leading to potential data corruption and unauthorized access to memory. The vulnerability was rectified by implementing check_mul_overflow() to ensure the buffer size is computed safely, preventing silent truncation and enhancing overall system stability.

References