CVE-2026-97590: Linux kernel · s390/crypto: Fix missing scrub of temp buffers with PAES algorithm
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in d7159d2132e9aa51af7acb51c6742d9b30f987b3 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in d7159d2132e9aa51af7acb51c6742d9b30f987b3, 19a218b46b2471d370c11fb52040f36ac8d05d23, 7d1456d54b3c784cc2917c219a528092cefe30cd
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to d7159d2132e9aa51af7acb51c6742d9b30f987b3, 19a218b46b2471d370c11fb52040f36ac8d05d23 or 7d1456d54b3c784cc2917c219a528092cefe30cd.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A patch is available and has been applied in the Linux kernel. Users should update to the fixed versions identified by the commits d7159d2132e9aa51af7acb51c6742d9b30f987b3, 19a218b46b2471d370c11fb52040f36ac8d05d23, and 7d1456d54b3c784cc2917c219a528092cefe30cd. Since this is a kernel-level fix, applying the updated kernel version is the recommended mitigation.
Description
A vulnerability in the Linux kernel's s390 crypto implementation involving the PAES algorithm was fixed. The issue was a missing scrub (clearing) of temporary buffers used to process data smaller than AES block size, potentially exposing sensitive data. The fix involves explicitly scrubbing these buffers to prevent data leakage.