HIGH Introduced in 6.16
pseries PhyAttest Overflow
CVE-2026-80571
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In papr_phy_attest_create_handle(), the params->cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is either 0 or exceeds sizeof(params->cmd). Also, params is freed on the success path but not error. Free it on errors after memory allocation. And free it on negative fd.
02KernelScan AI Analysis
Risk summary
An unprivileged local user on an IBM Power (pSeries) system can trigger a heap buffer overflow in the physical-attestation RTAS character driver by supplying an oversized length field via ioctl. This can lead to kernel memory corruption, enabling privilege escalation, information disclosure, or denial of service. The vulnerability also includes a memory leak on error paths that can be repeated to exhaust kernel memory.
Vulnerability analysis
In the papr physical-attestation character driver on IBM Power pSeries systems, a user-supplied command length field copied from userspace via ioctl is used without validation. When the length exceeds the size of the internal command buffer, subsequent processing reads or writes past the end of the allocated heap object, causing a buffer overflow. Additionally, the allocated parameter structure is leaked on several error paths because cleanup is missing. The fix adds a bounds check that rejects zero or oversized length values before they are used, and ensures the parameter structure is freed on every error return. The vulnerable code path is reachable by any local user who can open the /dev/papr-physical-attestation device and issue an ioctl, which requires no special privileges; the device exists only on pSeries Power hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.46 | 828a8d1a9107 |
| 7.1 | 6.16 | 7.1.10 | ed98ce338f9a |
| mainline | 6.16 | 7.2 | 5b17f3f34391 |