{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80544", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.765Z", "datePublished": "2026-08-26T14:37:16.367Z", "dateUpdated": "2026-08-27T05:01:31.626Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:31.626Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing\n\nThe zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct\noverlays to access and modify the domain field in the EP11 CPRB\npayload, creating maintainability and security concerns:\n1. Struct overlay approach (pld_hdr) assumes fixed payload structure\n and doesn't validate the actual ASN.1 encoding.\n2. Complex length format detection logic is error-prone and doesn't\n properly validate bounds at each parsing step.\n3. Direct struct member access bypasses proper ASN.1 validation.\n\nFix by replacing struct overlays with explicit ASN.1 parsing that\nvalidates each field (payload tag/length, function tag/length/value,\noptional domain tag/length/value) with proper bounds checking at every\nstep. Add asn1_int_encode() helper function to safely write integer\nvalues with correct endianness conversion. This makes the code\nconsistent with the validation pattern introduced with the rework of\nthe xcrb_msg_to_type6_ep11cprb_msgx() function."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via the ZSENDEP11CPRB ioctl on /dev/z90crypt (or a zcrypt class device node), following zcrypt_unlocked_ioctl() -> zsendep11cprb_ioctl() -> _zcrypt_send_ep11_cprb() -> zcrypt_msgtype6_send_ep11_cprb(); there is no network, USB, or remote packet path.\nAC:L - After prep_ep11_ap_msg() ASN.1 validation, an attacker can reliably trigger the flaw with a minimal non-management EP11 CPRB whose payload omits the domain field or uses variable ASN.1 length encodings; the overlay then writes dom_val at a miscalculated offset with no races or victim-dependent state.\nPR:L - The ioctl path performs only ap_perms bitmask checks (ioctl/card/queue masks default to all permitted) and no capability or real-root gate; any local user who can open the zcrypt character device can send crafted EP11 CPRBs, which is standard unprivileged local access on s390 systems with crypto hardware.\nUI:N - Exploitation requires only the attacker's own ioctl with attacker-controlled CPRB data; no separate victim action such as mounting a filesystem or opening a file is needed beyond the attacker's direct device access.\nS:U - The out-of-bounds write corrupts kernel heap memory inside the zcrypt driver's AP message buffer within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary to impact a separate authority.\nC:H - The unchecked struct overlay can write four bytes past the validated ASN.1 payload boundary inside a kernel-allocated AP message buffer; such heap corruption is exploitable for kernel memory disclosure and is scored as high confidentiality impact per memory-corruption guidance.\nI:H - zcrypt_msgtype6_send_ep11_cprb() performs an out-of-bounds 32-bit write of AP_QID_QUEUE() via payload_hdr->dom_val when ASN.1 layout does not match the assumed fixed pld_hdr overlay, enabling heap corruption and potential arbitrary kernel code execution.\nA:H - Writing past the validated EP11 CPRB payload into kernel heap memory can cause immediate kernel oops/panic or sustained denial of service through repeated ioctl-triggered corruption on IBM Z systems using EP11 crypto adapters."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/crypto/zcrypt_msgtype6.c"], "versions": [{"version": "e2c6d91eb8b1533753755f07803e47eceed263d0", "lessThan": "db21b2cf6dd0af5ffd08931e0a9fcda5a0473220", "status": "affected", "versionType": "git"}, {"version": "e2c6d91eb8b1533753755f07803e47eceed263d0", "lessThan": "0864a163783bff109b548266921829ea794edc93", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/crypto/zcrypt_msgtype6.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/db21b2cf6dd0af5ffd08931e0a9fcda5a0473220"}, {"url": "https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"}], "title": "s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/s390/crypto/zcrypt_msgtype6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "db21b2cf6dd0af5ffd08931e0a9fcda5a0473220", "status": "affected", "version": "e2c6d91eb8b1533753755f07803e47eceed263d0", "versionType": "git"}, {"lessThan": "0864a163783bff109b548266921829ea794edc93", "status": "affected", "version": "e2c6d91eb8b1533753755f07803e47eceed263d0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/s390/crypto/zcrypt_msgtype6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing\n\nThe zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct\noverlays to access and modify the domain field in the EP11 CPRB\npayload, creating maintainability and security concerns:\n1. Struct overlay approach (pld_hdr) assumes fixed payload structure\n and doesn't validate the actual ASN.1 encoding.\n2. Complex length format detection logic is error-prone and doesn't\n properly validate bounds at each parsing step.\n3. Direct struct member access bypasses proper ASN.1 validation.\n\nFix by replacing struct overlays with explicit ASN.1 parsing that\nvalidates each field (payload tag/length, function tag/length/value,\noptional domain tag/length/value) with proper bounds checking at every\nstep. Add asn1_int_encode() helper function to safely write integer\nvalues with correct endianness conversion. This makes the code\nconsistent with the validation pattern introduced with the rework of\nthe xcrb_msg_to_type6_ep11cprb_msgx() function."}], "id": "CVE-2026-80544", "lastModified": "2026-08-27T06:17:35.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:17:08.763", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0864a163783bff109b548266921829ea794edc93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db21b2cf6dd0af5ffd08931e0a9fcda5a0473220"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing", "id": "2524495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524495"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing\nThe zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct\noverlays to access and modify the domain field in the EP11 CPRB\npayload, creating maintainability and security concerns:\n1. Struct overlay approach (pld_hdr) assumes fixed payload structure\nand doesn't validate the actual ASN.1 encoding.\n2. Complex length format detection logic is error-prone and doesn't\nproperly validate bounds at each parsing step.\n3. Direct struct member access bypasses proper ASN.1 validation.\nFix by replacing struct overlays with explicit ASN.1 parsing that\nvalidates each field (payload tag/length, function tag/length/value,\noptional domain tag/length/value) with proper bounds checking at every\nstep. Add asn1_int_encode() helper function to safely write integer\nvalues with correct endianness conversion. This makes the code\nconsistent with the validation pattern introduced with the rework of\nthe xcrb_msg_to_type6_ep11cprb_msgx() function.", "A flaw was found in the Linux kernel's s390/zcrypt component. The `zcrypt_msgtype6_send_ep11_cprb()` function, responsible for handling EP11 CPRB (Coprocessor Request Block) domains, uses fragile struct overlays. This approach lacks proper ASN.1 (Abstract Syntax Notation One) encoding validation and bounds checking, creating security concerns. A local attacker could potentially exploit this vulnerability to manipulate the EP11 CPRB payload, leading to unexpected behavior or security bypasses within cryptographic operations."], "name": "CVE-2026-80544", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80544\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80544\nhttps://lore.kernel.org/linux-cve-announce/2026082606-CVE-2026-80544-3bae@gregkh/T"], "threat_severity": "Moderate"}