Executive brief
The Linux kernel's s390 cryptographic module contains an input validation flaw in EP11 CPRB (cryptographic request block) processing. When a malicious domain value is supplied on custom crypto device nodes, the kernel fails to properly bounds-check the value, allowing an attacker to read adjacent heap memory. This could enable privilege escalation or information disclosure on affected s390 systems.
Technical details
The vulnerability is an incomplete bounds-check in the _zcrypt_send_ep11_cprb() function in drivers/s390/crypto/zcrypt_api.c. The domain parameter is compared against AUTOSEL_DOM instead of the correct limit AP_DOMAINS (256), allowing out-of-bounds access to the perms->adm array when processing administrative CPRBs on custom device nodes. The flaw occurs only when perms is a custom pointer (not the default ap_perms), requiring an attacker to either access custom device nodes or manipulate device permissions. An authenticated attacker can craft a CPRB with an invalid domain value to read uninitialized heap memory behind the perms->adm buffer. A patch changes the comparison from "domain < AUTOSEL_DOM" to "domain < AP_DOMAINS" to enforce the correct 256-domain limit.
Affected products
- Linux Linux kernel Multiple stable releases (linux-3.x through linux-6.x and later)
Timeline
- 2026-08-28: disclosed
- 2026-08-09: patched: Fix available in stable kernel branches