CVE-2026-80544 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and security concerns: 1. Struct overlay approach (pld_hdr) assumes fixed payload structure and doesn't validate the actual ASN.1 encoding. 2. Complex length format detection logic is error-prone and doesn't properly validate bounds at each parsing step. 3. Direct struct member access bypasses proper ASN.1 validation.
Fix by replacing struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, optional domain tag/length/value) with proper bounds checking at every step. Add asn1_int_encode() helper function to safely write integer values with correct endianness conversion. This makes the code consistent with the validation pattern introduced with the rework of the xcrb_msg_to_type6_ep11cprb_msgx() function.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel vulnerability in the s390 zcrypt subsystem involves a critical flaw within the EP11 CPRB domain handling mechanism, specifically located in the zcrypt_msgtype6_send_ep11_cprb function. This component is responsible for processing cryptographic requests on IBM System Z hardware using the EP11 protocol interface. The core technical issue stems from the use of fragile struct overlays to access and modify the domain field within the CPRB payload. Instead of parsing the incoming data according to its actual Abstract Syntax Notation One encoding, the code relies on casting raw byte buffers directly into predefined C structures. This approach assumes a fixed memory layout that may not align with the variable-length ASN.1 structure sent by clients or generated internally. Consequently, this bypasses essential validation steps required for secure protocol implementation, creating significant maintainability and security risks due to the lack of explicit boundary checks during data interpretation.
The operational impact of this vulnerability is severe because it allows potential memory corruption and unauthorized domain manipulation. The previous complex length format detection logic was error-prone and failed to properly validate bounds at each parsing step. By directly accessing struct members without verifying that the underlying buffer contains sufficient data or correctly formatted ASN.1 tags, an attacker could potentially craft malformed CPRB messages that cause out-of-bounds reads or writes. This can lead to kernel panics, privilege escalation if the domain field controls access permissions for cryptographic operations, or information disclosure through leaked memory contents. The lack of proper bounds checking means that malicious inputs could overwrite adjacent memory structures, compromising system integrity and stability in a multi-tenant virtualization environment where zcrypt resources are shared among multiple guests.
The resolution involves replacing the unsafe struct overlay approach with explicit ASN.1 parsing routines that validate each field rigorously. This includes verifying payload tags and lengths, function tags, and optional domain parameters before any data is accessed or modified. Each step of the parsing process now incorporates proper bounds checking to ensure that offsets do not exceed buffer limits. Additionally, a new helper function asn1_int_encode was introduced to safely write integer values with correct endianness conversion, ensuring consistency across different architectures. This fix aligns the codebase with the validation patterns established in related functions such as xcrb_msg_to_type6_ep11cprb_msgx, thereby standardizing security practices within the zcrypt subsystem and reducing future maintenance burdens while eliminating the specific attack vectors associated with unchecked memory access.
From a classification perspective, this vulnerability maps to CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write depending on the specific exploitation scenario where malformed input leads to buffer overruns. In terms of adversarial tactics, it relates to ATT&CK technique T1564 Hidden Elements if used for evasion or more broadly to privilege escalation vectors in kernel space. Mitigation strategies include applying the provided kernel patch which enforces strict ASN.1 compliance and bounds checking. System administrators should ensure that their Linux kernels are updated to versions containing this fix, particularly those running on IBM Z hardware with zcrypt modules enabled. Furthermore, implementing network-level filtering for cryptographic request payloads can provide an additional layer of defense by dropping malformed CPRB messages before they reach the kernel parsing logic, although reliance solely on external filters is insufficient given that local attackers may also trigger these code paths through direct device access or virtualization interfaces.