CVE-2026-97592

A flaw was found in the Linux kernel. During Advanced Encryption Standard (AES) cryptographic operations on s390 architectures, temporary memory buffers and parameter blocks are not properly cleared after use or during certain error paths. A local attacker could exploit this flaw to access residual memory, potentially leading to the disclosure of sensitive information.

A low impact information disclosure flaw was found in the Linux kernel cryptographic implementation for s390 (IBM Z) systems. In the AES CTR path, the temporary buffer used to process a trailing partial block (less than AES_BLOCK_SIZE) was not scrubbed after use, and in the AES GCM path the CPACF parameter block and the scatterlist-walk buffers (gw_in and gw_out) were not scrubbed on certain error paths. As a consequence, residual data such as partial plaintext or cryptographic intermediate values could remain in kernel memory after AES CTR or GCM operations. A local attacker able to run code on an affected s390 system could potentially expose this residual data, although doing so requires combining the flaw with a separate kernel memory disclosure weakness, since the flaw itself does not provide a direct mechanism to read kernel memory. For this reason, and because exploitation requires local access on the s390 architecture, Red Hat assesses the impact of this flaw as low.

The vulnerable code is present in the kernel packages of Red Hat Enterprise Linux 8.10, Red Hat Enterprise Linux 9.4 and later minor streams, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.16 and later (via RHEL CoreOS 9). On these streams the fix is currently deferred, so the residual risk of sensitive data remaining in unscrubbed kernel memory persists until a fix is released. Earlier Red Hat Enterprise Linux streams (RHEL 7, RHEL 8.4, 8.6, and 8.8, and RHEL 9.2) and OpenShift Container Platform 4.12 through 4.15 are not affected because the vulnerable code is not present in them.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.