CVE-2026-80546 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Improve CCA CPRB length and overflow checks
The xcrb_msg_to_type6cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could overflow during 4-byte boundary alignment, causing undersized buffer allocations or incorrect bounds checking. 2. Missing minimum size validation: The CPRBX structure is copied from userspace without verifying sufficient buffer length. Undersized buffers cause uninitialized memory access when reading structure fields like cprbx.cprb_len and cprbx.domain. 3. Arithmetic overflow in sum calculations: Adding control block and data block sizes could overflow, bypassing size checks and enabling buffer overflows.
Fix by using size_t for length calculations, adding U32_MAX boundary checks after alignment, validating minimum control block size before copying from userspace, and detecting sum calculation overflows.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel vulnerability in the s390 zcrypt subsystem involves a critical lack of input validation within the xcrb_msg_to_type6cprb_msgx function, which is responsible for processing cryptographic control blocks. This flaw stems from improper handling of integer arithmetic and buffer size verification during the conversion of Extended Cryptographic Request Block messages to Type 6 Control Program Request Blocks. The core issue lies in the use of signed integers for length calculations that are subject to alignment operations, specifically CEIL4 alignment which rounds up values to the nearest four-byte boundary. When these signed variables undergo arithmetic shifts or additions associated with this alignment process, they can overflow if the input value is sufficiently large. This integer overflow results in a truncated size being calculated, leading to undersized buffer allocations that are insufficient for the actual data payload required by the cryptographic operation.
Beyond the alignment-related overflow, there is a complete absence of validation regarding the minimum size of the incoming Control Program Request Block Extension structure before it is copied from userspace memory. The kernel directly copies this structure without verifying that the provided buffer length meets the necessary thresholds to contain all expected fields. Consequently, if an attacker supplies a truncated or undersized buffer, the subsequent reading of specific fields such as cprb_len and domain will access uninitialized memory regions. This behavior constitutes an out-of-bounds read vulnerability, which can lead to information disclosure by leaking kernel stack contents or heap data back to the unprivileged user space application that initiated the request.
Furthermore, the function performs arithmetic summation when calculating total sizes for control block and data block combinations without checking for potential overflows in these sum calculations. If the individual components are large enough, their addition can wrap around due to integer overflow limits, resulting in a deceptively small final size value. This bypasses subsequent bounds checks that rely on this calculated total, effectively allowing an attacker to trigger buffer overflow conditions where more data is written than allocated space permits. Such memory corruption vulnerabilities can be exploited to achieve arbitrary code execution with kernel privileges or cause denial of service through system crashes and instability.
From a classification perspective, these issues map directly to CWE-190 Integer Overflow or Wraparound for the arithmetic flaws involving signed integers and sum calculations, as well as CWE-787 Out-of-bounds Write due to undersized buffer allocations resulting from overflowed size values. The lack of input validation on user-supplied data before memory operations aligns with CWE-20 Improper Input Validation, while the potential for reading uninitialized memory corresponds to CWE-908 Use of Uninitialized Resource. In terms of attack vectors and techniques, this vulnerability facilitates exploitation via local privilege escalation or remote code execution depending on the exposure surface, fitting into MITRE ATT&CK technique T1068 Exploitation for Privilege Escalation when leveraged by a local attacker to gain higher system access.
The resolution involves several key technical improvements to harden the input processing logic. First, length calculations are migrated from signed integer types to size_t unsigned types, which prevents negative values and provides a larger range for positive sizes, reducing the likelihood of unexpected wrap-arounds during alignment operations. Second, explicit boundary checks against U32_MAX are implemented after the CEIL4 alignment step to ensure that aligned lengths do not exceed maximum allowable limits before any memory allocation occurs. Third, strict validation is added to verify that the incoming buffer length meets or exceeds the minimum required size for the CPRBX structure prior to initiating the copy operation from userspace, thereby preventing out-of-bounds reads of uninitialized fields. Finally, arithmetic overflow detection mechanisms are integrated into sum calculations involving control and data block sizes to ensure that total allocated memory accurately reflects the actual requirements without wrapping around to small values. These mitigations collectively restore integrity checks and prevent both information leakage and memory corruption attacks targeting this cryptographic subsystem.