CVE-2026-80543: s390/zcrypt: Pad trailing CCA or EP11 message with zeros
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
The both functions xcrbmsgtotype6cprbmsgx() and xcrbmsgtotype6ep11cprbmsgx() copy the user space message into a kernel buffer based on the message length. But on further processing the message is supposed to be 4 byte length adjusted. Thus up to 3 bytes of uninitialized kernel memory are forwarded to further processing steps and may unwanted expose kernel memory to the crypto card firmware.
This patch contains code to pad the gap between user space copied message and message buffer length sent down to further processing of the CCA or EP11 message to zeros.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel s390/zcrypt implementation to pad trailing CCA or EP11 messages with zeros so that the message is 4-byte length adjusted and no uninitialized kernel memory is forwarded to further card firmware processing (as described for xcrb_msg_to_type6cprb_msgx() / xcrb_msg_to_type6_ep11cprb_msgx()).
Linux kernel (s390/zcrypt) Pad trailing CCA or EP11 message with zeros = enabled (pad message with zeros)
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel s390/zcrypt path to process CCA or EP11 messages are exposed. The issue concerns messages whose length requires 4-byte alignment, leaving up to three trailing bytes in the kernel buffer uninitialized.
What does an attacker need to do to trigger the exposure?
An attacker needs to cause a CCA or EP11 message to be copied from user space through the affected zcrypt conversion functions with a length that is not already 4-byte aligned. The subsequent processing can then receive up to three bytes of uninitialized kernel memory.
What is the practical impact of the flaw?
Up to three bytes of uninitialized kernel memory may be forwarded to crypto card firmware during further CCA or EP11 message processing. The fix zero-pads the gap between the copied user message and the aligned buffer length.
How can the issue be mitigated if an update is not immediately available?
The provided data does not identify a configuration workaround. Reducing or preventing use of the affected s390/zcrypt CCA and EP11 message-processing paths would avoid the described exposure until the kernel fix can be deployed.