CVE-2026-80708

A flaw was found in the Linux kernel's s390/zcrypt module. During the clear key to secure key token import process, an internal buffer used by the _ip_cprb_helper() function was not properly scrubbed after use. This oversight could leave sensitive clear key material in memory. A local attacker could potentially reuse this memory to expose the cryptographic key material, leading to information disclosure.

A moderate information disclosure flaw was found in the Linux kernel's s390/zcrypt module. During the clear key to secure key token import process, the internal buffer used by the _ip_cprb_helper() function was not scrubbed after use, which could leave clear cryptographic key material in kernel memory. A local attacker able to trigger the clear key import path and subsequently reuse the affected memory could expose this key material, resulting in disclosure of sensitive cryptographic key material. The kernel and kernel-rt components in Red Hat Enterprise Linux 9 and 10 and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2 are affected; the fix for these streams is deferred to a future update, so the residual risk is that clear key material may remain in unscrubbed kernel memory on s390 systems that use clear key imports until the fix is applied. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.