CVE-2026-80545 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Improve EP11 CPRB length and overflow checks
The xcrb_msg_to_type6_ep11cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11_cprb structure and subsequent payload fields (pld_tag, pld_lenfmt) are copied from userspace without verifying sufficient buffer length. 2. Arithmetic overflow in length calculations: CEIL4 alignment could overflow, bypassing size checks and enabling buffer overflows. 3. The payload is asn1 encoded but the function just uses a simple c struct overlay to access some fields of the payload.
Fix by using size_t for length calculations, adding U32_MAX boundary checks after alignment, and validating minimum request size and minimum reply size before copying from userspace. Do a very simple asn1 parsing of the payload up to the function value field.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel vulnerability in the s390 zcrypt subsystem involves critical flaws within the xcrb_msg_to_type6_ep11cprb_msgx() function, which is responsible for processing cryptographic requests from userspace applications interacting with IBM EP11 hardware security modules. This function serves as a bridge between user-level cryptographic operations and the underlying kernel drivers that interface with specialized encryption coprocessors on s390 architecture systems. The core issue stems from inadequate input validation when handling data structures passed by unprivileged or potentially malicious users, creating opportunities for memory corruption and privilege escalation attacks.
The first major technical flaw is a missing minimum size validation mechanism. When the function receives an ep11_cprb structure along with subsequent payload fields such as pld_tag and pld_lenfmt from userspace, it proceeds to copy this data without verifying that the provided buffer length is sufficient to contain these structures. This oversight allows attackers to supply truncated or malformed input that causes the kernel to read beyond the allocated memory boundaries during processing. Such out-of-bounds reads can lead to information disclosure where sensitive kernel memory contents are exposed to userspace, potentially revealing cryptographic keys, system configuration details, or other security-critical data stored in adjacent memory regions.
A second critical vulnerability involves arithmetic overflow conditions within length calculations performed by the CEIL4 alignment routine. The function applies four-byte alignment padding to calculated lengths without checking for integer overflow scenarios. When input values approach maximum limits, the addition of padding bytes can wrap around due to unsigned integer arithmetic limitations, resulting in a significantly smaller aligned value than intended. This bypasses subsequent size checks that rely on these corrupted length values, effectively allowing attackers to trigger buffer overflows by supplying carefully crafted inputs that exploit this mathematical weakness. The overflow condition enables writes beyond allocated buffers during the processing of cryptographic payloads.
The third vulnerability relates to improper parsing methodology for ASN1 encoded payload data. Rather than implementing proper ASN1 decoding logic, the function employs a simple C struct overlay approach to access specific fields within the payload structure. This technique assumes that memory layout and field offsets remain consistent between userspace representations and kernel expectations, which is dangerous given potential differences in compiler optimizations, padding rules, or intentional manipulation by attackers. The lack of proper ASN1 parsing means the function cannot validate structural integrity or detect malformed encoding schemes that might be used to exploit subsequent processing logic flaws.
The operational impact of these vulnerabilities extends beyond simple memory corruption scenarios. Successful exploitation could allow local users to escalate privileges to root level by corrupting kernel data structures, executing arbitrary code through buffer overflow conditions, or causing denial of service situations via system crashes triggered by invalid memory accesses. In multi-tenant cloud environments utilizing s390 infrastructure, this vulnerability represents a significant risk as it enables cross-instance attacks where one tenant could compromise the host system and potentially access resources belonging to other tenants sharing the same physical hardware.
The remediation strategy implemented in the kernel update addresses these issues through multiple defensive programming techniques. Length calculations now utilize size_t data types which provide appropriate range for memory sizing operations, reducing overflow risk compared to smaller integer types. Explicit U32_MAX boundary checks are applied after alignment operations to prevent wraparound conditions that could bypass security validations. The fix also introduces comprehensive validation of minimum request and reply sizes before any userspace data copying occurs, ensuring buffers contain sufficient data before processing begins. Additionally, the implementation includes basic ASN1 parsing logic up to the function value field, providing better structural validation than previous struct overlay approaches while maintaining performance efficiency for common cryptographic operations.
This vulnerability maps directly to CWE-20 improper input validation and CWE-190 integer overflow or wraparound conditions in its root causes. The exploitation techniques align with ATT&CK Tactic TA0005 Defense Evasion through memory corruption, specifically relating to buffer overflow patterns documented under technique T1176. Organizations running s390 systems should ensure kernel updates are applied promptly as these fixes address fundamental security weaknesses that could be chained together for more sophisticated attacks targeting cryptographic infrastructure and system stability.