CVE-2026-97590

s390/crypto: Fix missing scrub of temp buffers with PAES algorithm

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 19, 2026
Reserved
Sep 24, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/crypto: Fix missing scrub of temp buffers with PAES algorithm

In function ctr_paes_do_crypt() there is a buffer used to process remaining bytes < AES_BLOCK_SIZE. This buffer was not scrubbed and thus could lead to expose of unwanted data. Rework the code to explicitly scrub the buffer at the end of the function to avoid exposure of maybe sensitive data.

In function __xts_2keys_prep_param() change the existing scrub to clean the whole param block instead of just the key field.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6cd87cb5ef6ca50ae17c371482ceaab1d635e232 to before 7d1456d54b3c784cc2917c219a528092cefe30cdAffected
  • 6cd87cb5ef6ca50ae17c371482ceaab1d635e232 to before d7159d2132e9aa51af7acb51c6742d9b30f987b3Affected
  • 6cd87cb5ef6ca50ae17c371482ceaab1d635e232 to before 19a218b46b2471d370c11fb52040f36ac8d05d23Affected
LinuxLinux
  • 6.16Affected
  • before 6.16Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.