CVE-2026-80584

This vulnerability affects the Linux kernel s390/qeth driver. The functions qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without validating a lower bound. The reply callback's bounds check performs a u32 subtraction (udata_len − udata_o...