GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80709 (GCVE-0-2026-80709)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22
VLAI
Title
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device nodes but may lead to access heap memory behind perms->adm when an administrative CPRB is sent. Add correct limit (AP_DOMAINS = 256) checking to fix this.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 4589f742718d0256ea6dd1f5a78be6e689bdb8aa (git)
Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < b505dcc8307d64468b463dfad45a03bf865c637e (git)
Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15 (git)
Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 672b12940e3f1336dfed5287412a71500adf2a76 (git)
Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 1223477ca88e2396eca440919d0ca8754df79bd5 (git)
Affected: cfd68b33094e1a92249850ff3c3c92ae9112a541 , < 983279d7f86ade73db86f886e09172dd567031b5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4589f742718d0256ea6dd1f5a78be6e689bdb8aa",
              "status": "affected",
              "version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
              "versionType": "git"
            },
            {
              "lessThan": "b505dcc8307d64468b463dfad45a03bf865c637e",
              "status": "affected",
              "version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
              "versionType": "git"
            },
            {
              "lessThan": "13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15",
              "status": "affected",
              "version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
              "versionType": "git"
            },
            {
              "lessThan": "672b12940e3f1336dfed5287412a71500adf2a76",
              "status": "affected",
              "version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
              "versionType": "git"
            },
            {
              "lessThan": "1223477ca88e2396eca440919d0ca8754df79bd5",
              "status": "affected",
              "version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
              "versionType": "git"
            },
            {
              "lessThan": "983279d7f86ade73db86f886e09172dd567031b5",
              "status": "affected",
              "version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix wrong domain value verification with EP11 CPRBs\n\nThere is a wrong upper limit check for the domain value when an EP11\nCPRB is processed for sending to a crypto card. This check is only\nactive on custom device nodes but may lead to access heap memory\nbehind perms-\u003eadm when an administrative CPRB is sent.\nAdd correct limit (AP_DOMAINS = 256) checking to fix this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via ZSENDEP11CPRB ioctl on an s390 zcrypt custom zcdn character device (zcrypt_unlocked_ioctl -\u003e zsendep11cprb_ioctl -\u003e _zcrypt_send_ep11_cprb); no network, radio, or physical-bus entry path exists.\nAC:L - A local attacker with a permitted zcdn fd fully controls ep11_urb/CPRB target_id and the admin flag; domain values 256-65534 reliably trigger the flawed test_bit_inv() past perms-\u003eadm without races or conditions outside attacker control.\nPR:L - Exploitation requires local access to a custom zcdn node with ZSENDEP11CPRB enabled in ioctlmask; IBM Z/LinuxONE deployments routinely delegate such restricted crypto device access to non-root service accounts, not init-namespace root alone.\nUI:N - The attacker triggers the flaw by issuing ZSENDEP11CPRB with a crafted administrative EP11 CPRB from their own process; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - Impact is kernel heap out-of-bounds read and bypass of per-device admin-domain filtering within the host kernel address space; it does not cross a VM, IOMMU, or other changed security-authority boundary.\nC:H - Using domain 256-65534 with an admin CPRB makes test_bit_inv() index beyond the 256-bit perms-\u003eadm bitmap, reading adjacent kmalloc heap memory behind the zcdn_device allocation.\nI:H - If the out-of-bounds read observes a set bit, the admask admin-domain check passes and unauthorized EP11 administrative CPRBs can reach crypto control domains outside the device\u0027s intended permissions.\nA:H - Large crafted domain values make test_bit_inv() read far beyond the zcdn_device kmalloc object, which can access unmapped memory and provoke a kernel oops or panic during the ioctl path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:25.717Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4589f742718d0256ea6dd1f5a78be6e689bdb8aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b505dcc8307d64468b463dfad45a03bf865c637e"
        },
        {
          "url": "https://git.kernel.org/stable/c/13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15"
        },
        {
          "url": "https://git.kernel.org/stable/c/672b12940e3f1336dfed5287412a71500adf2a76"
        },
        {
          "url": "https://git.kernel.org/stable/c/1223477ca88e2396eca440919d0ca8754df79bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/983279d7f86ade73db86f886e09172dd567031b5"
        }
      ],
      "title": "s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80709",
    "datePublished": "2026-08-28T06:53:09.439Z",
    "dateReserved": "2026-08-26T14:34:25.787Z",
    "dateUpdated": "2026-08-29T06:22:25.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80709",
      "date": "2026-09-16",
      "epss": "0.0012",
      "percentile": "0.02103"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:56:05.000Z",
      "cve": "CVE-2026-80709",
      "id": "msrc_CVE-2026-80709",
      "initial_release_date": "2026-08-29T01:05:24.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80709.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80709\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:56.523\",\"lastModified\":\"2026-08-29T07:16:52.373\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/zcrypt: Fix wrong domain value verification with EP11 CPRBs\\n\\nThere is a wrong upper limit check for the domain value when an EP11\\nCPRB is processed for sending to a crypto card. This check is only\\nactive on custom device nodes but may lead to access heap memory\\nbehind perms-\u003eadm when an administrative CPRB is sent.\\nAdd correct limit (AP_DOMAINS = 256) checking to fix this.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/s390/crypto/zcrypt_api.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cfd68b33094e1a92249850ff3c3c92ae9112a541\",\"lessThan\":\"4589f742718d0256ea6dd1f5a78be6e689bdb8aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cfd68b33094e1a92249850ff3c3c92ae9112a541\",\"lessThan\":\"b505dcc8307d64468b463dfad45a03bf865c637e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cfd68b33094e1a92249850ff3c3c92ae9112a541\",\"lessThan\":\"13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cfd68b33094e1a92249850ff3c3c92ae9112a541\",\"lessThan\":\"672b12940e3f1336dfed5287412a71500adf2a76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cfd68b33094e1a92249850ff3c3c92ae9112a541\",\"lessThan\":\"1223477ca88e2396eca440919d0ca8754df79bd5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cfd68b33094e1a92249850ff3c3c92ae9112a541\",\"lessThan\":\"983279d7f86ade73db86f886e09172dd567031b5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/s390/crypto/zcrypt_api.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1223477ca88e2396eca440919d0ca8754df79bd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/13e53d6ae1c3b2ff1be75b9ef09be26f4ec3ce15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4589f742718d0256ea6dd1f5a78be6e689bdb8aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/672b12940e3f1336dfed5287412a71500adf2a76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/983279d7f86ade73db86f886e09172dd567031b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b505dcc8307d64468b463dfad45a03bf865c637e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T07:35:45+00:00",
      "cve": "CVE-2026-80709",
      "id": "CVE-2026-80709",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80709.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:09:38Z",
      "cve": "CVE-2026-80709",
      "id": "CVE-2026-80709",
      "initial_release_date": "2026-08-28T16:33:26Z",
      "product_status:known_affected": "168",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80709",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80709.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.