SB20260928343 - Sensitive Information in Resource Not Removed Before Reuse in Linux kernel s390 crypto

Description

This security bulletin contains information about 1 vulnerability.

1) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-97592)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to failure to clear sensitive data from memory in the s390 AES CTR and GCM cryptographic routines when processing cryptographic requests. A local user can process cryptographic requests that leave sensitive data in temporary buffers to disclose sensitive information.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/11eca05d2062032e1f07d56be58ed0b99f4b1d63
• https://git.kernel.org/stable/c/8b7c3b6914f19caf648d05726a86af6326d3c2c6
• https://git.kernel.org/stable/c/8b90a47c4fba27bb4f2f086611742493629e9696
• https://git.kernel.org/stable/c/a83488cecb35f924b7541306ed84893bb9906196