SB2026082857 - Sensitive Information in Resource Not Removed Before Reuse in Linux kernel s390 crypto driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082857

SB2026082857 - Sensitive Information in Resource Not Removed Before Reuse in Linux kernel s390 crypto driver

Published: August 28, 2026

Security Bulletin ID SB2026082857
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-80708)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper clearing of sensitive information in _ip_cprb_helper() and cca_clr2cipherkey() when processing clear key import requests. A local user can trigger clear key import operations and expose residual clear key material from reused memory to disclose sensitive information.

The issue affects internal CPRB buffer memory as well as the random EXOR buffer used during the clear key to secure key token import process.


Remediation

Install update from vendor's website.

References