GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80546 (GCVE-0-2026-80546)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
s390/zcrypt: Improve CCA CPRB length and overflow checks
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrb_msg_to_type6cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could overflow during 4-byte boundary alignment, causing undersized buffer allocations or incorrect bounds checking. 2. Missing minimum size validation: The CPRBX structure is copied from userspace without verifying sufficient buffer length. Undersized buffers cause uninitialized memory access when reading structure fields like cprbx.cprb_len and cprbx.domain. 3. Arithmetic overflow in sum calculations: Adding control block and data block sizes could overflow, bypassing size checks and enabling buffer overflows. Fix by using size_t for length calculations, adding U32_MAX boundary checks after alignment, validating minimum control block size before copying from userspace, and detecting sum calculation overflows.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2c6d91eb8b1533753755f07803e47eceed263d0 , < 50fe5133dcb46449daf2435fa705264364411129 (git)
Affected: e2c6d91eb8b1533753755f07803e47eceed263d0 , < 35ac6754ba6da45fd193f5ce3f665f7490b830d5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_msgtype6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50fe5133dcb46449daf2435fa705264364411129",
              "status": "affected",
              "version": "e2c6d91eb8b1533753755f07803e47eceed263d0",
              "versionType": "git"
            },
            {
              "lessThan": "35ac6754ba6da45fd193f5ce3f665f7490b830d5",
              "status": "affected",
              "version": "e2c6d91eb8b1533753755f07803e47eceed263d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_msgtype6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Improve CCA CPRB length and overflow checks\n\nThe xcrb_msg_to_type6cprb_msgx() function lacks proper input\nvalidation, creating security vulnerabilities:\n1. Integer overflow after CEIL4 alignment: Signed int variables could\n   overflow during 4-byte boundary alignment, causing undersized\n   buffer allocations or incorrect bounds checking.\n2. Missing minimum size validation: The CPRBX structure is copied from\n   userspace without verifying sufficient buffer length. Undersized\n   buffers cause uninitialized memory access when reading structure\n   fields like cprbx.cprb_len and cprbx.domain.\n3. Arithmetic overflow in sum calculations: Adding control block and\n   data block sizes could overflow, bypassing size checks and enabling\n   buffer overflows.\n\nFix by using size_t for length calculations, adding U32_MAX boundary\nchecks after alignment, validating minimum control block size before\ncopying from userspace, and detecting sum calculation overflows."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in xcrb_msg_to_type6cprb_msgx(), reached only from the ZSECSENDCPRB ioctl on the s390 zcrypt character device (zcrypt_unlocked_ioctl -\u003e zsecsendcprb_ioctl -\u003e _zcrypt_send_cprb -\u003e prep_cca_ap_msg); there is no network, adjacent-radio, or physical-bus entry point.\nAC:L - An attacker with a zcrypt fd fully controls the ica_xcRB length fields and CPRB buffers and can craft values that bypass flawed CEIL4/sum checks on every ioctl; no race, timing dependency, or uncontrolled memory layout is required.\nPR:L - Exploitation needs only local access to a zcrypt device node with ZSECSENDCPRB permitted via zcrypt_check_ioctl(); on IBM Z/LinuxONE admins routinely delegate such access to non-root crypto service accounts through custom zcdn nodes, not init-namespace root alone.\nUI:N - The attacker triggers the flaw directly by issuing ZSECSENDCPRB with a crafted ica_xcRB from their own process; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - Impact is heap corruption and kernel memory disclosure within the host kernel address space during AP message preparation; it does not cross a VM, IOMMU, or other changed security-authority boundary.\nC:H - Undersized request_control_blk_length copies fewer than sizeof(CPRBX) bytes yet the code reads cprbx.cprb_len and cprbx.domain from uninitialized kmalloc memory; integer-overflow bypasses can also yield out-of-bounds reads beyond the allocated ap_msg buffer.\nI:H - Signed-int CEIL4 alignment and sum overflows can make ap_msg-\u003elen smaller than copied data and place req_data before the kmalloc buffer, enabling z_copy_from_user() heap buffer overflows and attacker-influenced memory corruption suitable for control-flow hijack.\nA:H - Heap underflow/overflow and corrupted AP message buffers can immediately oops or panic the kernel; prep_cca_ap_msg runs before any crypto hardware is required, so the crash primitive is repeatable from ioctl alone."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:33.755Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50fe5133dcb46449daf2435fa705264364411129"
        },
        {
          "url": "https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5"
        }
      ],
      "title": "s390/zcrypt: Improve CCA CPRB length and overflow checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80546",
    "datePublished": "2026-08-26T14:37:17.550Z",
    "dateReserved": "2026-08-26T14:34:25.765Z",
    "dateUpdated": "2026-08-27T05:01:33.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80546",
      "date": "2026-09-16",
      "epss": "0.00136",
      "percentile": "0.03405"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80546\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:08.977\",\"lastModified\":\"2026-08-27T06:17:36.067\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/zcrypt: Improve CCA CPRB length and overflow checks\\n\\nThe xcrb_msg_to_type6cprb_msgx() function lacks proper input\\nvalidation, creating security vulnerabilities:\\n1. Integer overflow after CEIL4 alignment: Signed int variables could\\n   overflow during 4-byte boundary alignment, causing undersized\\n   buffer allocations or incorrect bounds checking.\\n2. Missing minimum size validation: The CPRBX structure is copied from\\n   userspace without verifying sufficient buffer length. Undersized\\n   buffers cause uninitialized memory access when reading structure\\n   fields like cprbx.cprb_len and cprbx.domain.\\n3. Arithmetic overflow in sum calculations: Adding control block and\\n   data block sizes could overflow, bypassing size checks and enabling\\n   buffer overflows.\\n\\nFix by using size_t for length calculations, adding U32_MAX boundary\\nchecks after alignment, validating minimum control block size before\\ncopying from userspace, and detecting sum calculation overflows.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/s390/crypto/zcrypt_msgtype6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2c6d91eb8b1533753755f07803e47eceed263d0\",\"lessThan\":\"50fe5133dcb46449daf2435fa705264364411129\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2c6d91eb8b1533753755f07803e47eceed263d0\",\"lessThan\":\"35ac6754ba6da45fd193f5ce3f665f7490b830d5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/s390/crypto/zcrypt_msgtype6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/50fe5133dcb46449daf2435fa705264364411129\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T07:04:16+00:00",
      "cve": "CVE-2026-80546",
      "id": "CVE-2026-80546",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: s390/zcrypt: Improve CCA CPRB length and overflow checks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80546.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T00:50:14Z",
      "cve": "CVE-2026-80546",
      "id": "CVE-2026-80546",
      "initial_release_date": "2026-08-27T00:12:12Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80546",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80546.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.