CVE-2026-97588: Linux kernel · s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f6b263679aa72ad2e534bf93db55f2589549a40e : update Linux kernel when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f6b263679aa72ad2e534bf93db55f2589549a40e, e267bd142664a181474112392aeaa8b3d4b12f2e, 7a08507ea5b4d06ad8d269287913573f34467565
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to f6b263679aa72ad2e534bf93db55f2589549a40e, e267bd142664a181474112392aeaa8b3d4b12f2e or 7a08507ea5b4d06ad8d269287913573f34467565.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A patch is available and has been applied in fixed versions identified by specific commits. Users should upgrade from Linux kernel version 6.16 to a fixed version containing the patch. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.
Description
A vulnerability in the Linux kernel's s390 crypto subsystem causes indefinite blocking when hardware persistently returns a busy error (-EBUSY) during key conversion. The error is incorrectly treated as a queueing status, preventing the completion callback from firing and causing callers using crypto_wait_req() to hang. This issue has been fixed by mapping persistent -EBUSY errors to -EIO after retry exhaustion to ensure proper error propagation and callback invocation.