CVE-2026-80571: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In paprphyattestcreatehandle(), the params->cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).
Also, params is freed on the success path but not error. Free it on errors after memory allocation. And free it on negative fd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In papr_phy_attest_create_handle(), validate params->cmd.length before use and return -EINVAL when it is 0 or exceeds sizeof(params->cmd); free params on the negative-fd path and on all error paths after memory allocation.
Event History
Frequently Asked Questions
What input condition causes the memory-safety issue?
The command length is used without validation. A length of zero or a value larger than the command buffer size can trigger the issue.
What behavior indicates the fix is present?
The corrected code rejects a zero command length or one exceeding sizeof(params->cmd) with -EINVAL before using it.
Are there resource-management issues associated with failed requests?
Yes. The fix frees params on error paths after allocation and when the returned file descriptor is negative, preventing memory leaks in those cases.