Vulnerability-Lookup

GHSA-M8XM-PGRJ-WHRP

Vulnerability from github – Published: 2026-08-27 06:31 – Updated: 2026-08-27 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing

The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and security concerns: 1. Struct overlay approach (pld_hdr) assumes fixed payload structure and doesn't validate the actual ASN.1 encoding. 2. Complex length format detection logic is error-prone and doesn't properly validate bounds at each parsing step. 3. Direct struct member access bypasses proper ASN.1 validation.

Fix by replacing struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, optional domain tag/length/value) with proper bounds checking at every step. Add asn1_int_encode() helper function to safely write integer values with correct endianness conversion. This makes the code consistent with the validation pattern introduced with the rework of the xcrb_msg_to_type6_ep11cprb_msgx() function.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80544"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-26T15:17:08Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing\n\nThe zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct\noverlays to access and modify the domain field in the EP11 CPRB\npayload, creating maintainability and security concerns:\n1. Struct overlay approach (pld_hdr) assumes fixed payload structure\n   and doesn\u0027t validate the actual ASN.1 encoding.\n2. Complex length format detection logic is error-prone and doesn\u0027t\n   properly validate bounds at each parsing step.\n3. Direct struct member access bypasses proper ASN.1 validation.\n\nFix by replacing struct overlays with explicit ASN.1 parsing that\nvalidates each field (payload tag/length, function tag/length/value,\noptional domain tag/length/value) with proper bounds checking at every\nstep. Add asn1_int_encode() helper function to safely write integer\nvalues with correct endianness conversion. This makes the code\nconsistent with the validation pattern introduced with the rework of\nthe xcrb_msg_to_type6_ep11cprb_msgx() function.",
  "id": "GHSA-m8xm-pgrj-whrp",
  "modified": "2026-08-27T06:31:31Z",
  "published": "2026-08-27T06:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80544"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/db21b2cf6dd0af5ffd08931e0a9fcda5a0473220"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-80544 (GCVE-0-2026-80544)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01

Title

s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing

Summary

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and security concerns: 1. Struct overlay approach (pld_hdr) assumes fixed payload structure and doesn't validate the actual ASN.1 encoding. 2. Complex length format detection logic is error-prone and doesn't properly validate bounds at each parsing step. 3. Direct struct member access bypasses proper ASN.1 validation. Fix by replacing struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, optional domain tag/length/value) with proper bounds checking at every step. Add asn1_int_encode() helper function to safely write integer values with correct endianness conversion. This makes the code consistent with the validation pattern introduced with the rework of the xcrb_msg_to_type6_ep11cprb_msgx() function.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/db21b2cf6dd0af5ff…
https://git.kernel.org/stable/c/0864a163783bff109…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e2c6d91eb8b1533753755f07803e47eceed263d0 , < db21b2cf6dd0af5ffd08931e0a9fcda5a0473220 (git) Affected: e2c6d91eb8b1533753755f07803e47eceed263d0 , < 0864a163783bff109b548266921829ea794edc93 (git)
Linux	Linux	Affected: 7.1 Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_msgtype6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "db21b2cf6dd0af5ffd08931e0a9fcda5a0473220",
              "status": "affected",
              "version": "e2c6d91eb8b1533753755f07803e47eceed263d0",
              "versionType": "git"
            },
            {
              "lessThan": "0864a163783bff109b548266921829ea794edc93",
              "status": "affected",
              "version": "e2c6d91eb8b1533753755f07803e47eceed263d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_msgtype6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing\n\nThe zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct\noverlays to access and modify the domain field in the EP11 CPRB\npayload, creating maintainability and security concerns:\n1. Struct overlay approach (pld_hdr) assumes fixed payload structure\n   and doesn\u0027t validate the actual ASN.1 encoding.\n2. Complex length format detection logic is error-prone and doesn\u0027t\n   properly validate bounds at each parsing step.\n3. Direct struct member access bypasses proper ASN.1 validation.\n\nFix by replacing struct overlays with explicit ASN.1 parsing that\nvalidates each field (payload tag/length, function tag/length/value,\noptional domain tag/length/value) with proper bounds checking at every\nstep. Add asn1_int_encode() helper function to safely write integer\nvalues with correct endianness conversion. This makes the code\nconsistent with the validation pattern introduced with the rework of\nthe xcrb_msg_to_type6_ep11cprb_msgx() function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the ZSENDEP11CPRB ioctl on /dev/z90crypt (or a zcrypt class device node), following zcrypt_unlocked_ioctl() -\u003e zsendep11cprb_ioctl() -\u003e _zcrypt_send_ep11_cprb() -\u003e zcrypt_msgtype6_send_ep11_cprb(); there is no network, USB, or remote packet path.\nAC:L - After prep_ep11_ap_msg() ASN.1 validation, an attacker can reliably trigger the flaw with a minimal non-management EP11 CPRB whose payload omits the domain field or uses variable ASN.1 length encodings; the overlay then writes dom_val at a miscalculated offset with no races or victim-dependent state.\nPR:L - The ioctl path performs only ap_perms bitmask checks (ioctl/card/queue masks default to all permitted) and no capability or real-root gate; any local user who can open the zcrypt character device can send crafted EP11 CPRBs, which is standard unprivileged local access on s390 systems with crypto hardware.\nUI:N - Exploitation requires only the attacker\u0027s own ioctl with attacker-controlled CPRB data; no separate victim action such as mounting a filesystem or opening a file is needed beyond the attacker\u0027s direct device access.\nS:U - The out-of-bounds write corrupts kernel heap memory inside the zcrypt driver\u0027s AP message buffer within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary to impact a separate authority.\nC:H - The unchecked struct overlay can write four bytes past the validated ASN.1 payload boundary inside a kernel-allocated AP message buffer; such heap corruption is exploitable for kernel memory disclosure and is scored as high confidentiality impact per memory-corruption guidance.\nI:H - zcrypt_msgtype6_send_ep11_cprb() performs an out-of-bounds 32-bit write of AP_QID_QUEUE() via payload_hdr-\u003edom_val when ASN.1 layout does not match the assumed fixed pld_hdr overlay, enabling heap corruption and potential arbitrary kernel code execution.\nA:H - Writing past the validated EP11 CPRB payload into kernel heap memory can cause immediate kernel oops/panic or sustained denial of service through repeated ioctl-triggered corruption on IBM Z systems using EP11 crypto adapters."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:31.626Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/db21b2cf6dd0af5ffd08931e0a9fcda5a0473220"
        },
        {
          "url": "https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"
        }
      ],
      "title": "s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80544",
    "datePublished": "2026-08-26T14:37:16.367Z",
    "dateReserved": "2026-08-26T14:34:25.765Z",
    "dateUpdated": "2026-08-27T05:01:31.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.