phmac EngineTransfer Race

Vulnerability analysis

The s390 protected key HMAC driver fails to recognize that a -EBUSY return from the crypto engine transfer function means the request was successfully queued. Only -EINPROGRESS was treated as a success code, so when the engine queue is full and returns -EBUSY, the driver incorrectly runs its cleanup path — zeroing the request's cryptographic context and decrementing the engine usage counter — while the crypto engine is still actively processing that same request. This results in the engine operating on corrupted (zeroed) memory and an incorrect reference count, which can produce wrong hash results or crash the kernel. The fix treats -EBUSY as an additional success indicator, skipping cleanup when the request has been accepted by the engine. The vulnerable path is reachable from local userspace through the kernel crypto API (such as AF_ALG sockets) on s390 systems where the PHMAC module is loaded, and exploitation requires concurrent crypto operations to fill the engine queue and trigger the EBUSY return.