CVE-2026-80571

A flaw was found in the Linux kernel's powerpc/pseries: papr-phy-attest component. This vulnerability arises from insufficient validation of a command length parameter, which can lead to a buffer overflow. Such an overflow could be exploited by a local attacker to potentially execute arbitrary code or cause a system crash (denial of service). Additionally, improper memory deallocation in error handling paths could result in a memory leak, further contributing to system instability.

A kernel buffer overflow may occur in the powerpc pseries papr physical attestation character driver because params cmd length is copied from user input and used without validating that it is non zero and within the size of the command structure. A local attacker with access to the papr physical attestation device can provide an oversized length value and may corrupt kernel memory during the attestation command handling path. For the CVSS the PR:L is used because reliable triggering requires local code execution and access to the exposed character device or its ioctl path, but it does not necessarily require full administrator privileges if device permissions or delegated service access allow use by a non root process. The issue is not network reachable and is limited to local systems on affected powerpc pseries configurations where this driver is present and accessible. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.