Executive brief
A security vulnerability was identified in the Linux kernel's s390 cryptographic subsystem. This component is responsible for managing protected encryption keys on IBM Z (s390x) mainframe systems. An issue in how the system handles user requests could potentially allow a local user to cause system instability or access memory they should not have access to by providing an invalid data length.
Technical details
A vulnerability exists in the s390 pkey API within the Linux kernel, specifically in the 'pkey_ioctl_verifyprotk' function in 'drivers/s390/crypto/pkey_api.c'. The issue stems from a lack of explicit bounds checking on the 'protkey.len' field provided by user-space via the PKEY_VERIFYPROTK ioctl. If a user provides a length value that exceeds the internal buffer size, it could lead to out-of-bounds memory access. The fix introduces a check to ensure the requested length does not exceed the destination buffer size and returns -EINVAL if it does. This vulnerability requires local access to the system to execute ioctl commands on the pkey device. Patches have been merged into various stable branches including 6.12.y, 6.18.y, and 7.1.y.
Affected products
- Linux Linux Kernel 6.12 to 6.12.97, 6.18 to 6.18.40, 7.1 to 7.1.5
Timeline
- 2026-06-15: other: Initial patch authored
- 2026-07-24: patched: Patch committed to stable trees
- 2026-07-29: disclosed: CVE published