CVE-2026-68453: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix buffer over-read in ccacipher2protkey
Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken() functions. Additionally check in ccagencipherkey() for possible underflow with returned key size.
The CCA token structures contain user-controlled len fields that were used in operations without proper validation against both the actual buffer size and minimum token structure size. An attacker could set this field larger than the actual buffer size, leading to reading beyond buffer boundaries. This may result in a kernel crash or exposure of memory via sending this as part of a request down to the crypto card. Also an attacker could have used a very small len value and thus enforce a buffer under-run which may produce similar effects as a over-read.
So now a key must - key buf length must be at least sizeof the token struct - the key len field inside the token must fit into the range of sizeof key token struct ... key buf length
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.44 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.8 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In all cca_check_sec*token() functions, validate both the actual key buffer size and the token length fields: require the key buffer length to be at least sizeof the token structure, ensure the token's key length fits within the key token structure and actual buffer, and reject values that could cause buffer over-read or under-run. Additionally, check cca_gencipherkey() for underflow involving the returned key size.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68453?
The severity of CVE-2026-68453 is rated at risk 37.
What does CVE-2026-68453 affect?
CVE-2026-68453 affects the Linux kernel, specifically the s390/zcrypt subsystem.
How do I fix CVE-2026-68453?
To fix CVE-2026-68453, it is recommended to apply the latest updates to the Linux kernel that address this vulnerability.
What kind of vulnerability is CVE-2026-68453?
CVE-2026-68453 is a buffer over-read vulnerability in the cca_cipher2protkey function.
What functions are impacted by CVE-2026-68453?
CVE-2026-68453 impacts the cca_check_sec*token() functions and cca_gencipherkey() in the kernel's s390/zcrypt subsystem.