CVE-2026-97588

A flaw was found in the Linux kernel's s390 cryptographic subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) by executing cryptographic operations when underlying hardware repeatedly reports a busy state. Because the subsystem fails to properly translate persistent busy errors during key conversion, the cryptographic framework incorrectly treats the failure as a queued request, preventing completion callbacks from firing and causing calling processes to hang indefinitely.

A low impact denial of service flaw was found in the Linux kernel's s390 cryptographic subsystem. When the underlying crypto hardware persistently reports a busy (-EBUSY) status after retries are exhausted during key conversion, the driver propagates -EBUSY to the crypto API completion wrapper, which interprets it as a queueing status rather than a terminal failure. As a result, the completion callback never fires, and processes waiting via crypto_wait_req() block indefinitely. A local user able to initiate cryptographic operations on an affected s390 system can therefore cause those processes to hang; there is no impact on confidentiality or integrity. Because triggering the hang requires an uncommon, persistent hardware busy condition outside the attacker's direct control, Red Hat rates the impact of this flaw as low, even though the CVSS:3.1 base score is moderate (5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code is only present in recent kernels: Red Hat Enterprise Linux 6, 7, 8, and 9 (including the corresponding kernel-rt and RHEL CoreOS-based OpenShift releases) are not affected because the vulnerable code is not present, while Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected. The fix is currently deferred for the affected streams; the residual risk is limited to a local, condition-dependent hang of tasks performing s390 cryptographic operations, with no memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.