# CVE-2026-80710: s390/dasd: Fix undersized format-check buffer

> An integer overflow in the s390/dasd driver leads to an undersized buffer allocation, allowing out-of-bounds writes and potential privilege escalation.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 28 Aug 2026
- **Updated:** 16 Oct 2026
- **Also known as:** AZL-98193, BELL-CVE-2026-80710, DEBIAN-CVE-2026-80710, GHSA-4j75-ggwr-gg59, UBUNTU-CVE-2026-80710

## What is CVE-2026-80710?

CVE-2026-80710 is a high-severity vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Fix undersized format-check buffer

fmt_buffer_size in dasd_eckd_check_device_format() is declared as
int, even though one of the multiplicands, sizeof(struct eckd_count),
is a size_t. The expression

    trkcount * rpt_max * sizeof(struct eckd_count)

is therefore correctly evaluated at 64-bit width, but the result is
silently truncated when it is stored back into the 32-bit
fmt_buffer_size variable. For a sufficiently large track range
(start_unit/stop_unit are caller-controlled) this truncation
yields a buffer size far smaller than the number of tracks actually
requested. kzalloc() then succeeds with an undersized allocation,
while the subsequent channel program build still operates on the
untruncated track count and writes past the end of that buffer.

Compute the buffer size with check_mul_overflow() and keep it in a
size_t, so that a value that no longer fits results in -EINVAL
instead of a silently truncated allocation size.

## Which versions are affected by CVE-2026-80710?


## How do I fix CVE-2026-80710?

Apply the vendor's patch.

## Is CVE-2026-80710 being exploited?

There is no known exploitation of CVE-2026-80710 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-80710 and fix it if it is affected.

What it is: CVE-2026-80710 is a high-severity vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-80710 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-80710/ (Markdown: https://insights.sbomify.com/CVE-2026-80710/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-80710
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80710
- OSV: https://osv.dev/vulnerability/CVE-2026-80710

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-80710/
Summaries are generated and may contain mistakes; the official description above is the record.