Linux Kernel up to 7.1.9 s390 zcrypt uninitialized pointer

Summaryinfo

A vulnerability categorized as problematic has been discovered in Linux Kernel up to 7.1.9. This impacts the function xcrb_msg_to_type6cprb_msgx/xcrb_msg_to_type6_ep11cprb_msgx of the component s390 zcrypt. The manipulation results in uninitialized pointer. This vulnerability is cataloged as CVE-2026-80543. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.9. It has been classified as problematic. Affected is the function xcrb_msg_to_type6cprb_msgx/xcrb_msg_to_type6_ep11cprb_msgx of the component s390 zcrypt. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. CWE is classifying the issue as CWE-824. The product accesses or uses a pointer that has not been initialized. This is going to have an impact on confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() copy the user space message into a kernel buffer based on the message length. But on further processing the message is supposed to be 4 byte length adjusted. Thus up to 3 bytes of uninitialized kernel memory are forwarded to further processing steps and may unwanted expose kernel memory to the crypto card firmware. This patch contains code to pad the gap between user space copied message and message buffer length sent down to further processing of the CCA or EP11 message to zeros.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-80543 since 08/26/2026. The exploitability is told to be easy. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 7.1.10 eliminates this vulnerability. Applying the patch 2db92a56b000173d332b6c30f38a5a4444e4355a/eb363254472493e3458156fc11fd56dca92f4333 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion