EUVD-2026-66499
GHSA-cmjf-x265-ccvj
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:L confirmed by ioctl access model; PR:L because CAP_NET_ADMIN is conventionally required for qeth network management ioctls, making PR:N unsubstantiated.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with
if ((udata_len - udata_offset) < len)
Both fields are u32, so a udata_len smaller than udata_offset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from kzalloc(), which the existing NULL check does not catch.
Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow.
AnalysisAI
Heap buffer overflow in the Linux kernel's s390/qeth driver exposes IBM System z hosts to local kernel memory corruption via malformed SNMP and ARP query ioctl calls. Affected systems run Linux kernel versions from 2.6.26 through the last unfixed stable releases across eight stable branches, with patches available in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to be running on IBM System z (s390/s390x) architecture with the qeth kernel driver loaded and at least one qeth network device configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 8.4 score with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects low-complexity local exploitation with full kernel-level impact, but the PR:N value warrants independent verification: qeth SNMP and ARP query ioctls are network management operations that conventionally require CAP_NET_ADMIN, suggesting the realistic privilege bar may be PR:L or higher depending on whether user namespace configurations on a given deployment allow unprivileged ioctl dispatch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker on an IBM System z Linux host with network management capability identifies a qeth-backed network interface and issues an ARP query or SNMP ioctl, setting udata_len to zero or any value below the fixed udata_offset. The unsigned subtraction in the reply callback wraps to a large value, bypassing the length guard, and the subsequent memcpy writes attacker-influenced data into adjacent kernel heap memory. … |
| Remediation | The primary remediation is to upgrade to a patched stable kernel release: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2, each containing the bounds-validation fix applied before the kzalloc call. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM System z systems running Linux kernels between versions 2.6.26 and the latest unfixed stable releases in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today