CVE-2026-80571: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In paprphyattestcreatehandle(), the params->cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).
Also, params is freed on the success path but not error. Free it on errors after memory allocation. And free it on negative fd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate params->cmd.length in papr_phy_attest_create_handle(): return -EINVAL if params->cmd.length is 0 or greater than sizeof(params->cmd), before it is used, to prevent buffer overflow.
Linux kernel: powerpc/pseries papr-phy-attest (papr_phy_attest_create_handle()) Return -EINVAL for invalid cmd.length = -EINVAL when params->cmd.length is 0 or exceeds sizeof(params->cmd) - Operational
Fix the mem leak by freeing params on the error/negative path: free it on the negative fd as described, since params is freed on the success path but not on error.
Event History
Frequently Asked Questions
What input condition causes the memory-safety issue?
The command length is used without validation. A length of zero or a value larger than the command buffer size can trigger the issue.
What behavior indicates the fix is present?
The corrected code rejects a zero command length or one exceeding sizeof(params->cmd) with -EINVAL before using it.
Are there resource-management issues associated with failed requests?
Yes. The fix frees params on error paths after allocation and when the returned file descriptor is negative, preventing memory leaks in those cases.