SB2026082794 - Use of uninitialized resource in Linux kernel s390 crypto driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-80543)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of uninitialized memory in xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() in the s390 zcrypt message type 6 handling code when processing user-supplied CCA or EP11 messages with lengths that are not 4-byte aligned. A local user can submit a crafted message to disclose sensitive information.

Up to 3 bytes of uninitialized kernel memory may be forwarded to crypto card firmware during further processing.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2db92a56b000173d332b6c30f38a5a4444e4355a
• https://git.kernel.org/stable/c/eb363254472493e3458156fc11fd56dca92f4333