Look up another CVE · open CVE-2026-80545 in the interactive tracker
CVE-2026-80545
s390/zcrypt: Improve EP11 CPRB length and overflow checks
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem drivers/s390. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80545 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The xcrb_msg_to_type6_ep11cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11_cprb structure and subsequent payload fields (pld_tag, pld_lenfmt) are copied from userspace without verifying sufficient buffer length. 2. Arithmetic overflow in length calculations: CEIL4 alignment could overflow, bypassing size checks and enabling buffer overflows. 3. The payload is asn1 encoded but the function just uses a simple c struct overlay to access some fields of the payload. Fix by using size_t for length calculations, adding U32_MAX boundary checks after alignment, and validating minimum request size and minimum reply size before copying from userspace. Do a very simple asn1 parsing of the payload up to the function value field.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/s390/crypto/zcrypt_msgtype6.c
- What this is
- S390 ZCRYPT AND PKEY DRIVER AND AP BUSMAINTAINERS section matched on drivers/s390/crypto/ · linux-s390@vger.kernel.org · Supported
- Kernel module
- zcrypt
Check it on the machine
grep -wE 'CONFIG_S390|CONFIG_ZCRYPT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w zcryptPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 1 release. It does build it in 3 releases, so the answer depends on which release the machine runs.
- bookwormn
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64
- n
- not enabled on any flavour - this release does not build the code
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_S390, CONFIG_ZCRYPT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.19%, higher than 8.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/s390
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.18.57 | 6.18.57 | f463f474773a |
| 7.1 | 7.1.10 | 2976b9d2e716 |
| 7.1 | 7.2 | 17ac0bc866fc |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is reached only via local ioctl(ZSENDEP11CPRB) on /dev/z90crypt or administrator-created zcdn device nodes on IBM Z systems with EP11 crypto hardware; there is no network, Bluetooth, or USB packet path to this code.
- AC:LAttack complexity, low
- The attacker fully controls ep11_urb req_len, req, and resp_len in the ioctl argument; near-SIZE_MAX lengths can wrap CEIL4 sum checks to bypass bufsize validation and trigger deterministic heap corruption without races or external timing dependencies.
- PR:LPrivileges required, low
- Exploitation requires opening a zcrypt device and passing zcrypt_check_ioctl, access routinely delegated to non-root application/service accounts via zcdn nodes on shared IBM Z cloud, LPAR, and container deployments that grant EP11 CPRB ioctl permissions.
- UI:NUser interaction, none
- Triggering is self-contained by submitting a crafted EP11 request block through ioctl; no victim interaction, file opening by another user, or administrative action beyond having zcrypt device access is required.
- S:UScope, unchanged
- Impact is kernel heap corruption and privilege escalation within the same Linux security authority on the s390 host; it does not cross VM, IOMMU, or container sandbox boundaries to affect a separate security domain.
- C:HConfidentiality impact, high
- Undersized copies leave uninitialized kmalloc data readable via struct overlays on pld_lenfmt and payload_hdr, while integer-overflowed req_len values enable copy_from_user far beyond the ap_msg buffer, providing arbitrary kernel memory disclosure primitives.
- I:HIntegrity impact, high
- Missing minimum-size and U32_MAX boundary checks let attacker-controlled lengths bypass ap_msg->len validation and corrupt adjacent kmalloc objects in the crypto message buffer, enabling heap control primitives and potential arbitrary kernel code execution.
- A:HAvailability impact, high
- Heap buffer overflow and out-of-bounds parsing of EP11 CPRB payloads can cause kernel oops, panic, or denial of crypto services on mission-critical IBM Z systems; memory corruption alone threatens host availability even before full exploitation.