CVE-2026-97589

A flaw was found in the Linux kernel's s390 cryptographic drivers. When handling asynchronous cryptographic operations, certain request callbacks incorrectly propagate error codes back to the crypto engine after already completing a request. This causes the crypto engine to mistakenly perform a second completion on the same request. A local user submitting cryptographic requests that encounter errors could trigger this condition, potentially leading to a kernel crash and a Denial of Service (DoS).

The s390 protected key AES and PHMAC do_one_request callbacks explicitly finalize an asynchronous crypto request but return the negative operation result to the crypto engine. The engine can interpret this return value as a failure to take ownership and complete the same request for a second time. The first completion callback may release the request or related state before the second completion accesses it, creating a potential use after free or double free condition. For the CVSS the PR:L value is used because a local user or process must access the affected crypto algorithm and submit an operation that reaches an error path. The issue is not directly network reachable. Impact is at least a local denial of service via kernel crash and in the worst case may include confidentiality and integrity impact if the double completion produces exploitable memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.