In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The… (CVE-2026-80544)

The vulnerability in the Linux kernel's s390/zcrypt subsystem involved the zcrypt_msgtype6_send_ep11_cprb() function using fragile struct overlays to access and modify the domain field in the EP11 CPRB payload. This approach assumed a fixed payload structure without validating the ASN.1 encoding, had error-prone length detection logic, and bypassed proper ASN.1 validation by directly accessing struct members. The fix replaces the struct overlays with explicit ASN.1 parsing that validates each field with proper bounds checking and introduces an asn1_int_encode() helper function to safely write integer values with correct endianness conversion. This aligns the code with validation patterns used elsewhere in the subsystem.

The vulnerability could lead to improper handling of ASN.1 encoded data in the EP11 CPRB payload, potentially causing security issues such as data corruption or unauthorized access due to lack of proper validation. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

A fix has been implemented that replaces fragile struct overlays with explicit ASN.1 parsing and proper bounds checking. Users should update to the Linux kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel release notes for the official patch and remediation guidance.