CVE-2026-80544 (GCVE-0-2026-80544)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and security concerns: 1. Struct overlay approach (pld_hdr) assumes fixed payload structure and doesn't validate the actual ASN.1 encoding. 2. Complex length format detection logic is error-prone and doesn't properly validate bounds at each parsing step. 3. Direct struct member access bypasses proper ASN.1 validation. Fix by replacing struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, optional domain tag/length/value) with proper bounds checking at every step. Add asn1_int_encode() helper function to safely write integer values with correct endianness conversion. This makes the code consistent with the validation pattern introduced with the rework of the xcrb_msg_to_type6_ep11cprb_msgx() function.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2c6d91eb8b1533753755f07803e47eceed263d0 , < db21b2cf6dd0af5ffd08931e0a9fcda5a0473220 (git)
Affected: e2c6d91eb8b1533753755f07803e47eceed263d0 , < 0864a163783bff109b548266921829ea794edc93 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_msgtype6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "db21b2cf6dd0af5ffd08931e0a9fcda5a0473220",
              "status": "affected",
              "version": "e2c6d91eb8b1533753755f07803e47eceed263d0",
              "versionType": "git"
            },
            {
              "lessThan": "0864a163783bff109b548266921829ea794edc93",
              "status": "affected",
              "version": "e2c6d91eb8b1533753755f07803e47eceed263d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_msgtype6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing\n\nThe zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct\noverlays to access and modify the domain field in the EP11 CPRB\npayload, creating maintainability and security concerns:\n1. Struct overlay approach (pld_hdr) assumes fixed payload structure\n   and doesn\u0027t validate the actual ASN.1 encoding.\n2. Complex length format detection logic is error-prone and doesn\u0027t\n   properly validate bounds at each parsing step.\n3. Direct struct member access bypasses proper ASN.1 validation.\n\nFix by replacing struct overlays with explicit ASN.1 parsing that\nvalidates each field (payload tag/length, function tag/length/value,\noptional domain tag/length/value) with proper bounds checking at every\nstep. Add asn1_int_encode() helper function to safely write integer\nvalues with correct endianness conversion. This makes the code\nconsistent with the validation pattern introduced with the rework of\nthe xcrb_msg_to_type6_ep11cprb_msgx() function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the ZSENDEP11CPRB ioctl on /dev/z90crypt (or a zcrypt class device node), following zcrypt_unlocked_ioctl() -\u003e zsendep11cprb_ioctl() -\u003e _zcrypt_send_ep11_cprb() -\u003e zcrypt_msgtype6_send_ep11_cprb(); there is no network, USB, or remote packet path.\nAC:L - After prep_ep11_ap_msg() ASN.1 validation, an attacker can reliably trigger the flaw with a minimal non-management EP11 CPRB whose payload omits the domain field or uses variable ASN.1 length encodings; the overlay then writes dom_val at a miscalculated offset with no races or victim-dependent state.\nPR:L - The ioctl path performs only ap_perms bitmask checks (ioctl/card/queue masks default to all permitted) and no capability or real-root gate; any local user who can open the zcrypt character device can send crafted EP11 CPRBs, which is standard unprivileged local access on s390 systems with crypto hardware.\nUI:N - Exploitation requires only the attacker\u0027s own ioctl with attacker-controlled CPRB data; no separate victim action such as mounting a filesystem or opening a file is needed beyond the attacker\u0027s direct device access.\nS:U - The out-of-bounds write corrupts kernel heap memory inside the zcrypt driver\u0027s AP message buffer within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary to impact a separate authority.\nC:H - The unchecked struct overlay can write four bytes past the validated ASN.1 payload boundary inside a kernel-allocated AP message buffer; such heap corruption is exploitable for kernel memory disclosure and is scored as high confidentiality impact per memory-corruption guidance.\nI:H - zcrypt_msgtype6_send_ep11_cprb() performs an out-of-bounds 32-bit write of AP_QID_QUEUE() via payload_hdr-\u003edom_val when ASN.1 layout does not match the assumed fixed pld_hdr overlay, enabling heap corruption and potential arbitrary kernel code execution.\nA:H - Writing past the validated EP11 CPRB payload into kernel heap memory can cause immediate kernel oops/panic or sustained denial of service through repeated ioctl-triggered corruption on IBM Z systems using EP11 crypto adapters."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:31.626Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/db21b2cf6dd0af5ffd08931e0a9fcda5a0473220"
        },
        {
          "url": "https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"
        }
      ],
      "title": "s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80544",
    "datePublished": "2026-08-26T14:37:16.367Z",
    "dateReserved": "2026-08-26T14:34:25.765Z",
    "dateUpdated": "2026-08-27T05:01:31.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80544",
      "date": "2026-09-01",
      "epss": "0.00142",
      "percentile": "0.03787"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80544\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:08.763\",\"lastModified\":\"2026-08-27T06:17:35.497\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing\\n\\nThe zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct\\noverlays to access and modify the domain field in the EP11 CPRB\\npayload, creating maintainability and security concerns:\\n1. Struct overlay approach (pld_hdr) assumes fixed payload structure\\n   and doesn\u0027t validate the actual ASN.1 encoding.\\n2. Complex length format detection logic is error-prone and doesn\u0027t\\n   properly validate bounds at each parsing step.\\n3. Direct struct member access bypasses proper ASN.1 validation.\\n\\nFix by replacing struct overlays with explicit ASN.1 parsing that\\nvalidates each field (payload tag/length, function tag/length/value,\\noptional domain tag/length/value) with proper bounds checking at every\\nstep. Add asn1_int_encode() helper function to safely write integer\\nvalues with correct endianness conversion. This makes the code\\nconsistent with the validation pattern introduced with the rework of\\nthe xcrb_msg_to_type6_ep11cprb_msgx() function.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/s390/crypto/zcrypt_msgtype6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2c6d91eb8b1533753755f07803e47eceed263d0\",\"lessThan\":\"db21b2cf6dd0af5ffd08931e0a9fcda5a0473220\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2c6d91eb8b1533753755f07803e47eceed263d0\",\"lessThan\":\"0864a163783bff109b548266921829ea794edc93\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/s390/crypto/zcrypt_msgtype6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db21b2cf6dd0af5ffd08931e0a9fcda5a0473220\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T13:38:41+00:00",
      "cve": "CVE-2026-80544",
      "id": "CVE-2026-80544",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80544.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.