CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device nodes but may lead to access heap memory behind perms->adm when an administrative CPRB is sent. Add correct limit (APDOMAINS = 256) checking to fix this.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected check is active only on custom device nodes. Systems that do not use custom zcrypt device nodes are not exposed through this code path.
What is required to trigger the vulnerable path?
An administrative EP11 CPRB must be sent to a crypto card with a domain value that passes the incorrect upper-bound validation. This can cause access to heap memory beyond perms->adm.