CVE-2026-80709

A flaw was found in the Linux kernel's s390/zcrypt component. An incorrect upper limit check for the domain value when processing an EP11 Cryptographic Coprocessor Request Block (CPRB) can allow a local user on custom device nodes to access heap memory. This could lead to information disclosure or other memory corruption related issues.

A moderate severity flaw was found in the Linux kernel s390/zcrypt driver used on IBM Z systems. When an EP11 Cryptographic Coprocessor Request Block (CPRB) is processed for sending to a crypto card, the domain value is verified against a wrong upper limit. This check is only active on custom zcrypt device nodes, so a local user able to send an administrative CPRB with an out-of-range domain value may access heap memory behind the perms->adm structure. This out-of-bounds memory access can crash the kernel and otherwise disclose or corrupt kernel heap memory. Red Hat rates this flaw as moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record scores it 7.8 (important); the difference reflects Red Hat's assessment that, in practice, the issue primarily affects availability and is reachable only by a local user with access to custom zcrypt device nodes on s390 systems. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10, and the kernel packages in Red Hat In-Vehicle OS, are affected and the fix is currently deferred to a future update for those streams; the residual risk is limited because exploitation requires local access to a system with custom zcrypt device nodes configured and the ability to issue administrative EP11 requests. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.