Executive brief
The Linux kernel's s390/zcrypt cryptographic message processing driver contains multiple integer and arithmetic overflow vulnerabilities in the xcrb_msg_to_type6cprb_msgx() function. These flaws allow local attackers to bypass buffer size checks, trigger uninitialized memory access, and cause buffer overflows when processing specially crafted CCA CPRB (CPRB = Cryptographic Protocol Request Block) messages, potentially leading to kernel crashes, information disclosure, or privilege escalation.
Technical details
The vulnerability consists of three distinct integer handling flaws in the xcrb_msg_to_type6cprb_msgx() function in drivers/s390/crypto/zcrypt_msgtype6.c: (1) Integer overflow after 4-byte boundary alignment (CEIL4) using signed int types, causing undersized buffer allocations; (2) Missing minimum size validation for the CPRBX structure copied from userspace, leading to uninitialized memory reads when accessing structure fields like cprbx.cprb_len and cprbx.domain; (3) Arithmetic overflow in sum calculations when adding control block and data block sizes, bypassing subsequent size checks. The fix converts length calculations to size_t, adds U32_MAX boundary checks post-alignment, validates minimum CPRBX size before copying from userspace, and detects overflow in size summation. Attack vectors require local access to invoke the ioctl syscall with malformed XCRB messages. The patch was committed upstream and backported to stable kernels from version 7.1 onward.
Affected products
- Linux Linux kernel 7.1 and later (s390 architecture only)
Timeline
- 2026-08-26: disclosed: CVE-2026-80546 published on NVD
- 2026-08-05: patched: Patch commit 35ac6754ba6da45fd193f5ce3f665f7490b830d5 merged upstream; backported to stable kernels 7.1+