CVE-2026-80545

A flaw was found in the Linux kernel's s390/zcrypt component. This vulnerability stems from insufficient input validation in the xcrb_msg_to_type6_ep11cprb_msgx() function when handling EP11 Cryptographic Coprocessor Request Block (CPRB) messages. A local attacker could exploit this by crafting a malicious message, leading to arithmetic overflows in length calculations and subsequent buffer overflows. This could result in a denial of service or potentially allow for privilege escalation.

A moderate severity flaw was found in the Linux kernel s390/zcrypt driver. The xcrb_msg_to_type6_ep11cprb_msgx() function did not properly validate EP11 Cryptographic Coprocessor Request Block (CPRB) messages supplied from userspace: the minimum size of the ep11_cprb structure and its payload fields (pld_tag, pld_lenfmt) was not verified, CEIL4 alignment arithmetic could overflow and bypass size checks, and fields of the ASN.1-encoded payload were read through a simple C struct overlay. A local attacker with access to the affected s390 zcrypt interface could craft a malicious EP11 CPRB request to trigger arithmetic overflows and buffer overflows, resulting in a denial of service or potentially privilege escalation. Red Hat rated this flaw Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVE.org severity of 7.8, because Red Hat assessed the practical impact as limited to availability. According to the current assessment, no Red Hat products are affected by this flaw: the vulnerable code is not present in the shipped Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel packages, so no Red Hat update is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.