In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The… (CVE-2026-80546)

The Linux kernel s390/zcrypt subsystem contained a vulnerability in the xcrb_msg_to_type6cprb_msgx() function due to insufficient input validation. Specifically, signed integer overflow could occur during 4-byte boundary alignment, causing undersized buffer allocations or incorrect bounds checking. Additionally, the CPRBX structure copied from userspace lacked minimum size validation, leading to potential uninitialized memory reads. Arithmetic overflow in summing control and data block sizes could bypass size checks, enabling buffer overflows. The patch replaced int with size_t for length calculations, added U32_MAX boundary checks after alignment, validated minimum control block size before copying from userspace, and detected sum calculation overflows to prevent these issues.

This vulnerability allows a local attacker with low privileges to cause buffer overflows and read uninitialized memory in the Linux kernel's s390/zcrypt component. The impact includes potential full confidentiality, integrity, and availability compromise of the affected system, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by improving input validation and overflow checks in the s390/zcrypt code. Users should apply the official kernel updates that include these patches. Since this is not a cloud service, remediation depends on deploying the updated kernel version. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.