CVE-2026-80544

A flaw was found in the Linux kernel's s390/zcrypt component. The zcrypt_msgtype6_send_ep11_cprb() function, responsible for handling EP11 CPRB (Coprocessor Request Block) domains, uses fragile struct overlays. This approach lacks proper ASN.1 (Abstract Syntax Notation One) encoding validation and bounds checking, creating security concerns. A local attacker could potentially exploit this vulnerability to manipulate the EP11 CPRB payload, leading to unexpected behavior or security bypasses within cryptographic operations.

A moderate-severity flaw was found in the Linux kernel's s390/zcrypt EP11 support. The zcrypt_msgtype6_send_ep11_cprb() function used fragile struct overlays to access and modify the domain field within the ASN.1-encoded EP11 CPRB payload, assuming a fixed payload structure without validating the actual ASN.1 encoding or properly checking bounds at each parsing step. On systems with the relevant s390 zcrypt EP11 hardware, a local attacker able to submit requests through the zcrypt EP11 interface could craft a malformed CPRB payload that the driver parses based on an assumed layout rather than validated ASN.1 tags and lengths, potentially causing out-of-bounds access and kernel memory corruption; the most plausible consequence is a kernel crash resulting in denial of service. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are affected, and the fix is currently deferred to a future update; the residual risk is limited because exploitation requires local access to the zcrypt EP11 interface on s390 systems and the verified impact is availability only. Red Hat rates this flaw moderate rather than the upstream important rating because exploitation requires local access to the zcrypt EP11 interface and no confidentiality or integrity impact has been established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.