Linux Kernel up to 7.1.7/7.2-rc5 s390/zcrypt array_index_nospec array index

Summaryinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 7.1.7/7.2-rc5. This issue affects the function array_index_nospec of the component s390/zcrypt. This manipulation causes array index. This vulnerability appears as CVE-2026-74466. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.7/7.2-rc5. It has been declared as problematic. Affected by this vulnerability is the function array_index_nospec of the component s390/zcrypt. The manipulation with an unknown input leads to a array index vulnerability. The CWE definition for the vulnerability is CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. As an impact it is known to affect confidentiality. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, administrative load) this value is used as an array index after bounds checking, but without speculation barrier. Add the missing array_index_nospec() call to prevent speculative execution where this domain value is used.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2026-74466 since 08/15/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/15/2026).

Upgrading to version 7.1.8 or 7.2-rc6 eliminates this vulnerability. Applying the patch 82b62eda68abfb7a33ac40f24b8c4128c2891148/e935cd525af4c6ed2e2c6404aa27ca19c7f39ddb is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4
• 7.2-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion