HIGH Introduced in 5.18
zcrypt DomainCheck OOB
CVE-2026-80709
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device nodes but may lead to access heap memory behind perms->adm when an administrative CPRB is sent. Add correct limit (AP_DOMAINS = 256) checking to fix this.
02KernelScan AI Analysis
Risk summary
A local user with access to s390 zcrypt custom device nodes can send an EP11 administrative CPRB with a domain value that bypasses an incorrect bounds check, causing the kernel to read heap memory beyond a permission bitmap. This enables a bit-by-bit information leak of adjacent heap contents and may cause a kernel oops if the out-of-range access hits unmapped memory. The vulnerability is specific to s390 systems with EP11 crypto hardware and requires access to the custom zcrypt device nodes.
Vulnerability analysis
When processing an EP11 administrative CPRB on a custom zcrypt device node, the kernel checks the supplied domain value against an incorrect upper limit that is larger than the actual allocated permission bitmap. A domain value within this gap passes the check and is then used as a bit index into the bitmap, reading heap memory beyond its bounds. Each query reveals one bit of adjacent heap data through a success-or-failure oracle, and sufficiently large domain values could fault on unmapped memory. The fix replaces the wrong limit with the correct maximum domain count so only valid indices reach the bitmap lookup. This path is reachable locally by any user who can open and send CPRBs through the custom zcrypt device nodes, which is gated by device node permissions on s390 systems equipped with EP11 crypto cards.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.18 | 6.1.183 | 4589f742718d |
| 6.12 | 5.18 | 6.12.103 | 13e53d6ae1c3 |
| 6.18 | 5.18 | 6.18.44 | 672b12940e3f |
| 6.6 | 5.18 | 6.6.151 | b505dcc8307d |
| 7.1 | 5.18 | 7.1.8 | 1223477ca88e |
| mainline | 5.18 | 7.2 | 983279d7f86a |
| cip/6.1 | 5.18 | 6.1.187-cip60 | 4589f742718d |
| cip/6.1-rt | 5.18 | 6.1.189-cip61-rt32 | 4589f742718d |
| cip/6.12 | 5.18 | 6.12.104-cip30 | 13e53d6ae1c3 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |