CVE-2026-80571 PUBLISHED

powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

Assigner: Linux
Reserved: 26.08.2026 Published: 26.08.2026 Updated: 26.08.2026

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

In papr_phy_attest_create_handle(), the params->cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).

Also, params is freed on the success path but not error. Free it on errors after memory allocation. And free it on negative fd.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 86900ab620a42396a749b506d4a187820fc3fabe to 828a8d1a9107aec6353d896882df8383accf7e80 (excl.)
  • affected from 86900ab620a42396a749b506d4a187820fc3fabe to ed98ce338f9a65c90cb930b088f1eb36de7181af (excl.)
  • affected from 86900ab620a42396a749b506d4a187820fc3fabe to 5b17f3f34391372faf03e79d947e0c50ab6dd258 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.16 is affected
  • unaffected from 0 to 6.16 (excl.)
  • unaffected from 6.18.46 to 6.18.* (incl.)
  • unaffected from 7.1.10 to 7.1.* (incl.)
  • unaffected from 7.2 to * (incl.)

References