SB20260928342 - Sensitive Information in Resource Not Removed Before Reuse in Linux kernel s390 crypto

Description

This security bulletin contains information about 1 vulnerability.

1) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-97590)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper clearing of sensitive information in PAES temporary buffers and parameter blocks when processing data with PAES cryptographic operations. A local user can invoke affected PAES cryptographic operations to disclose sensitive information.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/19a218b46b2471d370c11fb52040f36ac8d05d23
• https://git.kernel.org/stable/c/7d1456d54b3c784cc2917c219a528092cefe30cd
• https://git.kernel.org/stable/c/d7159d2132e9aa51af7acb51c6742d9b30f987b3