CVE-2026-64559

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached only through the PKEY_VERIFYPROTK ioctl on the /dev/pkey character device, which requires local access to the system. There is no network-facing path to this code.

AC:LAttack complexity, low

Triggering is fully deterministic — a single ioctl with protkey.len set to 0x20000010 wraps the u32 multiplication to a legal 128-bit keytype and drives the unchecked memcpy; no race, timing, or uncontrollable memory-layout condition is involved.

PR:LPrivileges required, low

The pkey miscdevice is registered with .mode = 0666 and neither the open handler nor pkey_unlocked_ioctl performs any capability check, so any unprivileged local user (including a normal shell user on a shared IBM Z LPAR or z/VM guest) can issue the ioctl.

UI:NUser interaction, none

The attacker performs the entire attack via its own ioctl call; no action by any other user or administrator is needed.

S:UScope, unchanged

The out-of-bounds read and write are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The unchecked memcpy performs a huge out-of-bounds read that walks off the 64-byte on-stack protkey buffer through the entire kernel stack, relocating arbitrary kernel stack contents — including protected key material handled by this crypto driver — into heap objects, an unbounded kernel memory disclosure primitive.

I:HIntegrity impact, high

This is a massive slab out-of-bounds write into an 80-byte kmalloc-96 allocation whose first 64 bytes are entirely attacker-supplied and whose subsequent bytes come from groomable kernel-stack data, corrupting adjacent slab objects and providing a heap-overflow primitive suitable for control-flow hijacking.

A:HAvailability impact, high

The smallest length that bypasses the keytype check requests a 512 MB copy, so the source pointer inevitably hits the VMAP_STACK guard page, producing an unhandled kernel fault/oops and panic after wide-scale heap corruption — a guaranteed, repeatable denial of service.