Look up another CVE · open CVE-2026-97589 in the interactive tracker
CVE-2026-97589
s390/crypto: Fix wrong return code to engine in asynch callbacks
Published 2026-09-25 (24 days ago) by the Linux kernel CNA. Subsystem arch/s390. Debian urgency: unimportant.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-97589 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0 to indicate successful handling. Returning a negative error code causes the crypto engine to assume the driver failed to take ownership and triggers a second completion via crypto_request_complete(), resulting in a double completion. This pattern occurs in paes_s390.c 4 times and once in phmac_s390.c. Fixed in phmac_do_one_request() and all four paes do_one_request callbacks (ecb, cbc, ctr, xts) by returning 0 after explicit finalization instead of propagating the error code.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/s390/crypto/paes_s390.c
arch/s390/crypto/phmac_s390.c
- What this is
- S390 CRYPTO MODULES, PRNG DRIVER, ARCH RANDOMMAINTAINERS section matched on arch/s390/crypto/ · linux-crypto@vger.kernel.org · Supported
- Kernel module
- none to look for. The file would have gone into paes_s390, and Debian does not compile it into that module, so finding paes_s390 in lsmod would say nothing about this CVE.
Check it on the machine
grep -w CONFIG_CRYPTO_PAES_S390 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switch
- CONFIG_CRYPTO_PAES_S390
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-25 (24 days ago)source
- CVSS
- 7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 3.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/s390
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.16 | 6.18.53 | 972e0d9b7d1d |
| 6.16 | 7.2.7 | 5480291aa848 |
| 6.16 | 7.3 | ac1481320110 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The faulty return is in ecb/cbc/ctr/xts_paes_do_one_request() and phmac_do_one_request(), which run in the crypto engine worker. They are reached through local crypto API users: AF_ALG sockets binding "ecb(paes)" etc. (algif_skcipher recvmsg -> ecb_paes_crypt -> engine) or dm-crypt. No remote peer supplies the data that causes the failure.
- AC:HAttack complexity, high
- The double completion fires only when the engine path returns an error. That needs the protected key to be invalidated (-EKEYEXPIRED, e.g. the wrapping key changed) and then re-conversion to fail in paes_convert_key() because the card is busy or offline. AF_ALG blocks setkey while op sockets exist, so the attacker cannot force this state.
- PR:LPrivileges required, low
- AF_ALG socket creation and binding the paes/phmac algorithms need no capability, so a local unprivileged user holding usable key material can push requests through the paes engine path.
- UI:NUser interaction, none
- No victim action is needed. Once the engine-side failure condition exists, the attacker's own AF_ALG requests (or ordinary dm-crypt I/O) hit the double completion.
- S:UScope, unchanged
- The corruption stays within the kernel's own security authority. There is no guest-to-host or other boundary crossing.
- C:HConfidentiality impact, high
- crypto_pump_requests() calls crypto_request_complete() a second time after crypto_finalize_skcipher_request(). In AF_ALG the extra complete of ctx->wait lets a later request's areq be freed while the engine still processes it, so the engine keeps reading freed memory (use-after-free).
- I:HIntegrity impact, high
- The engine's skcipher walk and cpacf output keep writing into the freed request and scatterlist memory. For dm-crypt, the same bio completes twice. Both are use-after-free writes that can be used for heap corruption.
- A:HAvailability impact, high
- The double completion corrupts request/bio lifetime (double bio end or a use-after-free on the areq), which can crash the kernel or corrupt dm-crypt I/O.