CVE-2026-80543
Description
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() copy the user space message into a kernel buffer based on the message length. But on further processing the message is supposed to be 4 byte length adjusted. Thus up to 3 bytes of uninitialized kernel memory are forwarded to further processing steps and may unwanted expose kernel memory to the crypto card firmware. This patch contains code to pad the gap between user space copied message and message buffer length sent down to further processing of the CCA or EP11 message to zeros.
How to fix
- Linux Linux44e61f1834831f873af5a4fec5a5e432b929c6a2, 2db92a56b000173d332b6c30f38a5a4444e4355a, eb363254472493e3458156fc11fd56dca92f4333, 6.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 20b0b0159390fa5c00a435195649680fefda81e0 ≤ v < 44e61f1834831f873af5a4fec5a5e432b929c6a2, e2c6d91eb8b1533753755f07803e47eceed263d0 ≤ v < 2db92a56b000173d332b6c30f38a5a4444e4355a, e2c6d91eb8b1533753755f07803e47eceed263d0 ≤ v < eb363254472493e3458156fc11fd56dca92f4333, f9da85d4780515f65983e0af151458599adaef3d, 6.12.114 ≤ v < 6.13, 7.1 | 44e61f1834831f873af5a4fec5a5e432b929c6a2, 2db92a56b000173d332b6c30f38a5a4444e4355a, eb363254472493e3458156fc11fd56dca92f4333, 6.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.