CVE-2026-80544: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing

Published Aug 26, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing

The zcryptmsgtype6sendep11cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and security concerns: 1. Struct overlay approach (pldhdr) assumes fixed payload structure and doesn't validate the actual ASN.1 encoding. 2. Complex length format detection logic is error-prone and doesn't properly validate bounds at each parsing step. 3. Direct struct member access bypasses proper ASN.1 validation.

Fix by replacing struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, optional domain tag/length/value) with proper bounds checking at every step. Add asn1intencode() helper function to safely write integer values with correct endianness conversion. This makes the code consistent with the validation pattern introduced with the rework of the xcrbmsgtotype6ep11cprbmsgx() function.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 26, 2026
CVE Published
via MITRE·02:37 PM
Data Sourced
via MITRE·02:37 PM
Description
Data Sourced
via NVD·03:17 PM
Description

Frequently Asked Questions

1

Which systems are most relevant to this issue?

The issue is relevant to Linux kernel deployments using the s390/zcrypt EP11 CPRB handling path, specifically the zcrypt_msgtype6_send_ep11_cprb() function. The provided information does not identify affected kernel versions or configurations.

2

What kind of input is involved in triggering the vulnerable behavior?

The affected code processes an EP11 CPRB payload containing ASN.1-encoded fields, including payload, function, and optional domain fields. Malformed or unexpected encoding and length values reaching this path are the inputs the fix now validates with bounds checks.

3

What does the fix change from a security perspective?

The fix replaces direct structure overlays and field access with explicit ASN.1 parsing and validation at each field and length boundary. It also adds safe integer encoding for writing domain values with correct endianness conversion.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203