In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The… (CVE-2026-80545)

The Linux kernel's s390/zcrypt component contained a vulnerability in the xcrb_msg_to_type6_ep11cprb_msgx() function where input from userspace was not properly validated. Specifically, the function lacked minimum size validation for the ep11_cprb structure and its payload fields, allowing insufficient buffer length checks. Additionally, arithmetic overflow in CEIL4 alignment calculations could bypass size checks, enabling buffer overflow conditions. The payload, which is ASN.1 encoded, was accessed via a simple C struct overlay without proper parsing. The fix involved switching to size_t for length calculations, adding U32_MAX boundary checks after alignment, validating minimum request and reply sizes before copying from userspace, and implementing simple ASN.1 parsing up to the function value field.

Exploitation of this vulnerability could lead to buffer overflows in kernel space, potentially allowing an attacker with local privileges to escalate privileges or cause denial of service. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local access with low privileges and no user interaction is needed.

A fix has been implemented in the Linux kernel to address this vulnerability by improving input validation and length checks in the affected function. Users should update their Linux kernel to a version that includes this patch. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or distribution security updates for the exact fixed versions and apply them accordingly.