CVE-2026-68452

s390/zcrypt: Validate length for CCA AES cipher key requests

State: Published
Severity: 7.8 High
Published: Aug 13, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA AES cipher key requests

cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

Product	Versions
LinuxLinux	4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before be037204e4f595e4bd2159acda146677a1dc6342Affected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 4e500ecb6704d879f9c2417c2ed6faba595015caAffected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 7f9e5a3dbb14a9b321a1dfa30390402c673f82dcAffected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 406b317ea2b501f6f5eca1264293c9399a73a778Affected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 4fc46deceda076d429ef3fab2ccf8d96629ebd23Affected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before ad93a1f1a45652478c0cf4eb029114e03af57f3bAffected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 3859f630b674801a00bca39bc451f52288591f65Affected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 06afe425d5283b9764303de47f554da5a808ce8aAffected
LinuxLinux	5.4Affected before 5.4Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before be037204e4f595e4bd2159acda146677a1dc6342Affected
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 4e500ecb6704d879f9c2417c2ed6faba595015caAffected
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 7f9e5a3dbb14a9b321a1dfa30390402c673f82dcAffected
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 406b317ea2b501f6f5eca1264293c9399a73a778Affected
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 4fc46deceda076d429ef3fab2ccf8d96629ebd23Affected
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before ad93a1f1a45652478c0cf4eb029114e03af57f3bAffected
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 3859f630b674801a00bca39bc451f52288591f65Affected
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to before 06afe425d5283b9764303de47f554da5a808ce8aAffected

LinuxLinux

5.4Affected
before 5.4Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.