CVE-2026-80543

A flaw was found in the Linux kernel's s390/zcrypt component. When copying user-space messages into a kernel buffer, the system fails to properly pad the message to a 4-byte length. This oversight can lead to up to three bytes of uninitialized kernel memory being exposed to the crypto card firmware, potentially resulting in information disclosure.

A moderate information disclosure flaw was found in the Linux kernel's s390/zcrypt driver, which is used for cryptographic operations on the IBM Z (s390x) architecture. When a user-space application submits a CCA or EP11 cryptographic request, the functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() copy the user message into a kernel buffer based on the message length, but further processing expects the message to be adjusted to a 4-byte length. As a result, up to 3 bytes of uninitialized kernel memory can be forwarded to the crypto card firmware, potentially exposing kernel memory contents. Exploiting this flaw requires local access to an s390x system and the ability to submit requests to the zcrypt device; the exposure is limited to a few bytes of uninitialized kernel memory sent to the crypto card firmware, with no impact on integrity or availability. Red Hat Product Security has rated this flaw as Moderate severity. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel, kernel-rt, and kernel-ivos-qualcomm components have been evaluated and marked not affected because the vulnerable code is not present in the shipped builds, so no Red Hat products are affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.