In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests… (CVE-2026-68452)
A vulnerability in the Linux kernel's s390/zcrypt component related to CCA AES cipher key requests has been resolved. The issue involved improper validation of the length field in the key token, which could lead to incorrect handling of the CPRB parameter block. The fix ensures that requests are rejected early if the token length exceeds the available space in the parameter block.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel s390/zcrypt module was due to cca_cipher2protkey() deriving the copy length for the CPRB parameter block directly from the length field in the key token without sufficient validation. This could allow a malformed key token with an excessive length field to be processed incorrectly. The resolution involves validating the token length and rejecting requests early if the token length exceeds the available space in the parameter block, preventing potential memory corruption or related issues.
Potential Impact
The impact is related to improper length validation in cryptographic key handling within the Linux kernel on s390 architecture. While specific exploitation details are not provided, improper length validation in cryptographic operations can lead to memory corruption or denial of service. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been applied in the Linux kernel to validate the length of the key token in CCA AES cipher key requests and reject invalid requests early. Users should update to the fixed Linux kernel version once available. Patch status is not explicitly confirmed; check the vendor or Linux kernel advisories for the exact fixed versions and update guidance.
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests… (CVE-2026-68452)
Description
A vulnerability in the Linux kernel's s390/zcrypt component related to CCA AES cipher key requests has been resolved. The issue involved improper validation of the length field in the key token, which could lead to incorrect handling of the CPRB parameter block. The fix ensures that requests are rejected early if the token length exceeds the available space in the parameter block.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel s390/zcrypt module was due to cca_cipher2protkey() deriving the copy length for the CPRB parameter block directly from the length field in the key token without sufficient validation. This could allow a malformed key token with an excessive length field to be processed incorrectly. The resolution involves validating the token length and rejecting requests early if the token length exceeds the available space in the parameter block, preventing potential memory corruption or related issues.
Potential Impact
The impact is related to improper length validation in cryptographic key handling within the Linux kernel on s390 architecture. While specific exploitation details are not provided, improper length validation in cryptographic operations can lead to memory corruption or denial of service. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been applied in the Linux kernel to validate the length of the key token in CCA AES cipher key requests and reject invalid requests early. Users should update to the fixed Linux kernel version once available. Patch status is not explicitly confirmed; check the vendor or Linux kernel advisories for the exact fixed versions and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wcc3-pw65-4r46
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-68452"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7e034fbf8831d5398f6e0a
Added to database: 08/13/2026, 17:47:59 UTC
Last enriched: 08/13/2026, 17:52:39 UTC
Last updated: 08/14/2026, 00:41:06 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.