CVE-2026-97590

A flaw was found in the Linux kernel. This vulnerability leads to information disclosure during protected Advanced Encryption Standard (PAES) operations on s390 architectures. Because the kernel fails to clear temporary memory buffers after cryptographic processing, a local attacker could access residual memory to expose sensitive cryptographic data.

A moderate information disclosure flaw was found in the Linux kernel's s390 protected AES (PAES) crypto implementation. In ctr_paes_do_crypt(), a temporary buffer used to process trailing bytes shorter than an AES block was not scrubbed at the end of the function, and in __xts_2keys_prep_param() the existing scrub covered only the key field instead of the whole temporary parameter block. As a result, residual cryptographic data, such as plaintext, ciphertext, or key-related parameters, could remain in reusable kernel memory on s390 systems. A local attacker able to trigger these cryptographic paths could expose this residual data, but only by combining the flaw with a separate mechanism that discloses stale memory contents, so the bug does not by itself provide a direct arbitrary-read primitive.

The vulnerable code, introduced by the rework of protected key AES for asynchronous support, is present in Red Hat Enterprise Linux 10.3 and 10.4 and in Red Hat In-Vehicle OS 2.0 and 2.1 (kernel and kernel-ivos-qualcomm components). These streams are marked affected with the fix deferred to a future update; the residual risk until a fix ships is that sensitive cryptographic material may persist in reusable kernel memory on affected s390 systems. All other Red Hat Enterprise Linux streams, kernel-rt, and the OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code is not present in those builds. Although an initial automated assessment suggested a lower severity given the high attack complexity of chaining this flaw with another memory-disclosure issue, the current Red Hat impact for this flaw is moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.