CVE-2026-80584

In the Linux kernel, the following vulnerability has been resolved:

s390/qeth: validate user buffer length in SNMP and ARP query ioctls

qethsnmpcommand() and qethl3arpquery() allocate a buffer sized by a user-supplied length (udatalen) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with

    if ((udata_len - udata_offset) < len)

Both fields are u32, so a udatalen smaller than udataoffset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udatalen of 0 also yields ZEROSIZE_PTR from kzalloc(), which the existing NULL check does not catch.

Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow.