SB20260816247 - Out-of-bounds read in Linux kernel s390 crypto driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-74466)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the s390 zcrypt ioctl CPRB handling in _zcrypt_send_cprb() and _zcrypt_send_ep11_cprb() when processing a user-controlled domain value under speculative execution. A local user can supply a crafted ioctl structure to disclose sensitive information.

Exploitation requires special conditions involving a custom device node and an administrative load path.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/82b62eda68abfb7a33ac40f24b8c4128c2891148
• https://git.kernel.org/stable/c/e935cd525af4c6ed2e2c6404aa27ca19c7f39ddb