CVE-2026-80546

A flaw was found in the Linux kernel's s390/zcrypt component, specifically within the xcrb_msg_to_type6cprb_msgx() function. This vulnerability is due to insufficient input validation, which can lead to integer overflows during memory allocation and arithmetic operations, as well as a lack of minimum size validation for the CPRBX structure. A local attacker could exploit these issues to cause buffer overflows, potentially leading to arbitrary code execution or information disclosure.

A moderate severity flaw was found in the Linux kernel's s390/zcrypt subsystem. The xcrb_msg_to_type6cprb_msgx() function, which converts userspace CCA security requests into type6 CPRB messages, lacked sufficient input validation. Signed integer variables could overflow during 4-byte (CEIL4) alignment, leading to undersized buffer allocations or incorrect bounds checking; the CPRBX structure was copied from userspace without verifying a minimum buffer length, so undersized buffers caused reads of uninitialized kernel memory when accessing fields such as cprb_len and domain; and summing control block and data block sizes could overflow, bypassing size checks and enabling buffer overflows. A local attacker able to submit requests through the zcrypt interface could exploit these flaws to cause buffer overflows, potentially resulting in information disclosure, arbitrary code execution, or a system crash (denial of service). Red Hat rated this flaw Moderate, with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the 7.8 score in the upstream CVE record, because Red Hat assesses the practical impact as limited to availability. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams have been assessed as not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.