CVE-2026-80710 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix undersized format-check buffer
fmt_buffer_size in dasd_eckd_check_device_format() is declared as int, even though one of the multiplicands, sizeof(struct eckd_count), is a size_t. The expression
trkcount * rpt_max * sizeof(struct eckd_count)
is therefore correctly evaluated at 64-bit width, but the result is silently truncated when it is stored back into the 32-bit fmt_buffer_size variable. For a sufficiently large track range (start_unit/stop_unit are caller-controlled) this truncation yields a buffer size far smaller than the number of tracks actually requested. kzalloc() then succeeds with an undersized allocation, while the subsequent channel program build still operates on the untruncated track count and writes past the end of that buffer.
Compute the buffer size with check_mul_overflow() and keep it in a size_t, so that a value that no longer fits results in -EINVAL instead of a silently truncated allocation size.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified as CVE-2024-s390-dasd-fix resides within the Linux kernel's s390 DASD (Direct Access Storage Device) subsystem, specifically affecting the device format checking logic for ECKD formatted devices. This issue stems from a classic integer overflow and type mismatch error in the function dasd_eckd_check_device_format(). The core technical flaw involves the variable fmt_buffer_size being declared as an int, which is typically a 32-bit signed integer on most architectures including s390x when running in certain compatibility modes or due to specific compiler defaults. However, the calculation determining the required buffer size multiplies track counts and record lengths using sizeof(struct eckd_count), where one of the operands is a size_t type representing an unsigned 64-bit value. While the arithmetic operation itself performs correctly at 64-bit width, assigning this result to the 32-bit int variable causes silent truncation if the calculated size exceeds the maximum positive value representable by a signed 32-bit integer.
This truncation leads directly to a heap-based buffer overflow condition. When an attacker or malicious user controls the start_unit and stop_unit parameters passed into the function, they can specify a track range that results in a total byte count exceeding two gigabytes minus one byte. The kernel then allocates memory using kzalloc based on this truncated, significantly smaller size. Subsequently, the channel program construction logic proceeds to write data corresponding to the full, untruncated number of tracks into this undersized buffer. This out-of-bounds write allows for arbitrary code execution or denial of service by corrupting adjacent heap metadata and kernel memory structures. The vulnerability is particularly dangerous because it involves user-controllable inputs influencing critical storage subsystem operations, potentially allowing local privilege escalation if the attacker has access to block devices managed by DASD drivers.
From a classification perspective, this flaw aligns with CWE-190 Integer Overflow or Wraparound, as the arithmetic operation produces a result that is too large for the destination variable type without proper validation. It also maps closely to CWE-787 Out-of-bounds Write, since the subsequent memory write exceeds the allocated buffer boundary due to the size discrepancy caused by the overflow. In terms of attack vectors and tactics, this vulnerability can be leveraged within the MITRE ATT&CK framework under T1059 Command and Scripting Interpreter if it leads to code execution, or more broadly as part of Local Privilege Escalation techniques where kernel memory corruption is exploited to gain higher system privileges. The specific context involves storage device management interfaces which may be accessible through standard block device operations depending on the configuration and access controls in place.
The mitigation implemented by the Linux kernel maintainers addresses this issue by replacing the int type with size_t for fmt_buffer_size, ensuring that the variable can hold values up to 64 bits without truncation. Furthermore, the fix incorporates check_mul_overflow() before performing the multiplication of track counts and record sizes. This function detects if any intermediate product exceeds the maximum value representable by a size_t and returns an error code rather than allowing silent wraparound or truncation. By returning -EINVAL when such overflow conditions are detected, the kernel prevents the allocation of undersized buffers entirely. This approach ensures that only valid, non-overlapping memory requests proceed to kzalloc, thereby eliminating the possibility of heap corruption via this specific path.
System administrators and developers should ensure that their Linux kernels are updated to versions containing this patch for s390 DASD drivers. Since this vulnerability affects a subsystem dealing with physical storage device formats, it is primarily relevant on IBM Z mainframe systems or emulated environments utilizing these devices. Regular security updates and adherence to best practices in kernel development regarding type safety and overflow checking are essential defenses against such integer-related vulnerabilities. The fix exemplifies the importance of using appropriate data types for size calculations and validating arithmetic operations before memory allocation, which serves as a critical defense-in-depth strategy against heap-based exploits in operating system kernels.