CVE-2026-74466

A flaw was found in the Linux kernel's s390/zcrypt component. Under specific conditions, a user-controlled domain value, derived from CCA or EP11 ioctl structures, is used as an array index without a proper speculation barrier. This oversight could allow for speculative memory reads, potentially leading to information disclosure. The vulnerability is addressed by adding a missing array_index_nospec() call to prevent such speculative execution.

A MODERATE information disclosure flaw was found in the Linux kernel s390/zcrypt subsystem shipped in Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2. When a CPRB is about to be sent, the domain value extracted from a user-supplied CCA or EP11 ioctl structure is used as an array index after bounds checking but without a speculation barrier. Under special conditions, such as when a custom zcrypt device node is used under administrative load, a local attacker could exploit speculative execution to perform out-of-bounds reads and potentially disclose kernel memory contents. The issue is rated MODERATE because exploitation requires local access to the zcrypt device, an uncommon system configuration, and a successful speculative-execution side channel, limiting the practical impact to confidentiality. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 releases, the fix has been deferred to a future update; the residual risk is considered low because triggering the flaw requires a custom device node setup with administrative load and only transient speculative reads are possible. Upstream addressed the issue by adding the missing array_index_nospec() call to prevent speculative execution where the domain value is used.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.