Look up another CVE · open CVE-2026-68385 in the interactive tracker
CVE-2026-68385
s390/checksum: Fix csum_partial() without vector facility
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem arch/s390. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-68385 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.101-1 | Update the kernel and reboot. Fixed in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. On machines without the vector facility, csum_copy() falls back to cksm(dst, ...), causing the checksum to be calculated from address zero instead of the source buffer. The VX implementation already checksums data loaded from src. Make the fallback do the same by passing src to cksm().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/s390/lib/csum-partial.c
- What this is
- S390 ARCHITECTUREMAINTAINERS section matched on arch/s390/ · linux-s390@vger.kernel.org · Supported
Show whether Debian builds this, per release
Debian builds this code. Every release with an answer below compiles the affected file into the kernels it ships. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sid, bookworm · linux-6.12y
- ?
- not established - no Makefile entry for the affected file
- y
- built into the kernel image on every flavour - only a patch removes it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.49%, higher than 40.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/s390
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.9 | 6.12.101 | 5fc0a2a6eeb9 |
| 6.9 | 6.18.42 | 1d9a2f01b3c4 |
| 6.9 | 7.1.6 | 898bb2814f38 |
| 6.9 | 7.2 | 4bb06b60d982 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- csum_partial() is the s390 software checksum used by the network stack on received and transmitted packets (skb_checksum, __skb_checksum_complete, ICMP/UDP/TCP, tunnels, GSO fallback); a remote peer both triggers the code and observes the resulting bad checksum values in packets sent back to it, with no local access needed.
- AC:LAttack complexity, low
- On any affected system (a machine or guest without the vector facility, i.e. pre-z13 hardware or a z/VM/KVM/QEMU CPU model lacking VX) the wrong-address checksum happens unconditionally and deterministically on every call, and eliciting replies of chosen lengths (e.g. ICMP echo) is trivially repeatable.
- PR:NPrivileges required, none
- No credentials or account are needed; simply sending packets to the host (or receiving its traffic) exercises the software checksum path, and the leaked checksum values are returned to an unauthenticated remote party.
- UI:NUser interaction, none
- Packet processing and checksum computation occur automatically in the kernel network stack with no action by any local user or administrator.
- S:UScope, unchanged
- The faulty read and its consequences stay within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- The checksum is computed over kernel memory at address 0 (the s390 lowcore: kernel stack/task pointers, PSWs, per-CPU state, and following low kernel memory) for an attacker-influenced length, and that value is emitted in transmitted packet checksum fields; differencing results over successive lengths reconstructs kernel memory contents remotely, defeating KASLR and disclosing kernel pointers.
- I:HIntegrity impact, high
- Computed checksums no longer depend on packet contents, so IP/TCP/UDP checksum verification is fully defeated: corrupted or attacker-modified payloads are accepted as valid by the stack and delivered to applications, destroying the integrity protection the checksum exists to provide.
- A:HAvailability impact, high
- All software-checksummed traffic carries or fails bogus checksums and is dropped, causing loss of network connectivity on affected machines, and where the identity mapping base is randomized or the lowcore is relocated the read from address 0 hits unmapped memory and triggers a program check / kernel crash.