Executive brief
The Linux kernel's s390 zcrypt cryptographic coprocessor driver contains input validation flaws in its EP11 CPRB message handler. An attacker could exploit missing size checks and arithmetic overflow conditions to trigger buffer overflows, potentially allowing privilege escalation or denial of service on affected s390 systems.
Technical details
The xcrb_msg_to_type6_ep11cprb_msgx() function in drivers/s390/crypto/zcrypt_msgtype6.c lacks proper validation of user-supplied data. Specifically: (1) missing minimum buffer size validation when copying ep11_cprb structure and payload fields from userspace, (2) arithmetic overflow in CEIL4 alignment calculations that can bypass length checks, and (3) incorrect assumption that ASN.1-encoded payloads can be accessed via simple C struct overlay. An unprivileged local user with access to the zcrypt device can supply specially crafted messages to trigger buffer overflows. The fix adds size_t-based length calculations, U32_MAX boundary checks, and proper ASN.1 parsing. Patches are available in Linux 7.1+ stable releases.
Affected products
- Linux Linux Kernel 7.1 and later
Timeline
- 2026-08-26: disclosed
- 2026-08-05: patched: Upstream fix in mainline; backported to stable 7.1+ in commit 2976b9d2e716