EUVD-2026-67445
GHSA-4j75-ggwr-gg59
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges required to invoke DASD format check; heap overflow yields full kernel memory confidentiality, integrity, and availability impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix undersized format-check buffer
fmt_buffer_size in dasd_eckd_check_device_format() is declared as int, even though one of the multiplicands, sizeof(struct eckd_count), is a size_t. The expression
trkcount * rpt_max * sizeof(struct eckd_count)
is therefore correctly evaluated at 64-bit width, but the result is silently truncated when it is stored back into the 32-bit fmt_buffer_size variable. For a sufficiently large track range (start_unit/stop_unit are caller-controlled) this truncation yields a buffer size far smaller than the number of tracks actually requested. kzalloc() then succeeds with an undersized allocation, while the subsequent channel program build still operates on the untruncated track count and writes past the end of that buffer.
Compute the buffer size with check_mul_overflow() and keep it in a size_t, so that a value that no longer fits results in -EINVAL instead of a silently truncated allocation size.
AnalysisAI
Integer truncation in the Linux kernel s390/dasd ECKD driver exposes IBM Z systems to a heap buffer overflow via a caller-controlled track range supplied to dasd_eckd_check_device_format(). The root cause is that fmt_buffer_size is declared as int while the buffer-size expression evaluates at size_t width, causing the result to be silently truncated on assignment; kzalloc() then allocates a buffer far smaller than needed, while the subsequent channel program builder operates on the untruncated track count and writes past the allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) s390 or s390x architecture - x86, ARM, and all other architectures are completely unaffected because the dasd driver is s390-only; (2) an IBM DASD ECKD storage device must be attached and accessible to the system, either physical or virtualized (z/VM guest); (3) a local, authenticated account with sufficient permissions to invoke the DASD format-check code path, consistent with CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local-access constraint: an authenticated user must be present on the s390 system and able to invoke the DASD format-check path with a crafted track range. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel version: 6.6.151 or later in the 6.6.x LTS branch, 6.12.103 or later in the 6.12.x branch, 6.18.44 or later in the 6.18.x branch, 7.1.8 or later in the 7.1.x branch, or any 7.2+ release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all IBM Z systems running s390 architecture to identify which operate vulnerable Linux kernel versions (prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2) and document their business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today