CVE-2026-80546

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is in xcrb_msg_to_type6cprb_msgx(), reached only from the ZSECSENDCPRB ioctl on the s390 zcrypt character device (zcrypt_unlocked_ioctl -> zsecsendcprb_ioctl -> _zcrypt_send_cprb -> prep_cca_ap_msg); there is no network, adjacent-radio, or physical-bus entry point.

AC:LAttack complexity, low

An attacker with a zcrypt fd fully controls the ica_xcRB length fields and CPRB buffers and can craft values that bypass flawed CEIL4/sum checks on every ioctl; no race, timing dependency, or uncontrolled memory layout is required.

PR:LPrivileges required, low

Exploitation needs only local access to a zcrypt device node with ZSECSENDCPRB permitted via zcrypt_check_ioctl(); on IBM Z/LinuxONE admins routinely delegate such access to non-root crypto service accounts through custom zcdn nodes, not init-namespace root alone.

UI:NUser interaction, none

The attacker triggers the flaw directly by issuing ZSECSENDCPRB with a crafted ica_xcRB from their own process; no separate victim action such as mounting a filesystem or opening a file is required.

S:UScope, unchanged

Impact is heap corruption and kernel memory disclosure within the host kernel address space during AP message preparation; it does not cross a VM, IOMMU, or other changed security-authority boundary.

C:HConfidentiality impact, high

Undersized request_control_blk_length copies fewer than sizeof(CPRBX) bytes yet the code reads cprbx.cprb_len and cprbx.domain from uninitialized kmalloc memory; integer-overflow bypasses can also yield out-of-bounds reads beyond the allocated ap_msg buffer.

I:HIntegrity impact, high

Signed-int CEIL4 alignment and sum overflows can make ap_msg->len smaller than copied data and place req_data before the kmalloc buffer, enabling z_copy_from_user() heap buffer overflows and attacker-influenced memory corruption suitable for control-flow hijack.

A:HAvailability impact, high

Heap underflow/overflow and corrupted AP message buffers can immediately oops or panic the kernel; prep_cca_ap_msg runs before any crypto hardware is required, so the crash primitive is repeatable from ioctl alone.