SB2026082793 - Improper input validation in Linux kernel s390 crypto driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-80545)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper input validation in xcrb_msg_to_type6_ep11cprb_msgx() when copying and parsing user-supplied EP11 CPRB data from userspace. A local user can supply a specially crafted request to execute arbitrary code.

The issue involves missing minimum size validation, arithmetic overflow in aligned length calculations, and unsafe parsing of asn1-encoded payload data through a simple structure overlay.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/17ac0bc866fc624cd05f022dcd8b730c0af11bb1
• https://git.kernel.org/stable/c/2976b9d2e716c7e5487ca7c29a7bd076cf9adf08