In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls …
CVE-2026-80584 · published 26 Aug 2026
How serious is it
- Severity: high, CVSS score 8.4 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-80584?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 2.6.26
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by
a user-supplied length (udata_len) without checking a lower bound, then
set udata_offset to a fixed non-zero value and pass both to a reply
callback. The callback bounds-checks the copy with
if ((udata_len - udata_offset) < len)
Both fields are u32, so a udata_len smaller than udata_offset makes the
subtraction wrap and the check pass, and the following memcpy() writes
past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from
kzalloc(), which the existing NULL check does not catch.
Reject buffers smaller than udata_offset before allocating, so the
callback subtraction can no longer underflow.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/3083818e67bcd656965797fbac9a3d6c1d44f78a
- git.kernel.org/stable/c/46443eaddebd84c51940857b11787229be169dec
- git.kernel.org/stable/c/75fb3151513d7d9f77a8f9545418279b119c06b8
- git.kernel.org/stable/c/91935843f9396a9e45253e2c0d4337ca1371754b
- git.kernel.org/stable/c/9d00eeb2d27f4cc817c5e408760226d43f811ec6
- git.kernel.org/stable/c/a3083647747942ea32faf14560d6397ff3068046
- git.kernel.org/stable/c/cc423f4105fe145b33e1d7cad34245a798358f73
- git.kernel.org/stable/c/d141f087b1af656f055d7c5793a3e87817ba0bbe
Merged from NVD. Last updated 24 Oct 2026. All vulnerabilities · RSS · JSON