CVE-2026-97592: s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
In the Linux kernel, the following vulnerability has been resolved:
s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
In function ctraescrypt() there is a buffer used to process remaining bytes < AESBLOCKSIZE. This buffer was not scrubbed and thus could lead to expose of unwanted data. When the buffer is used explicitly scrub it at the end of the code block to avoid exposure of maybe sensitive data.
In a similar way the function gcmaescrypt() hat an error path where the CPACF param block was not scrubbed. Instead of return early now these error paths go to end of function where explicit scrubbing is done. Similar with the buffers which are part of the gcmsgwalk structs from the variables gwin and gwout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Explicitly scrub temporary buffers and the CPACF parameter block before returning, including buffers used by ctr_aes_crypt(), gcm_aes_crypt(), and gcm_sg_walk; ensure error paths that reach the end of the function perform the scrubbing, including remaining bytes smaller than AES_BLOCK_SIZE and the buffers represented by gw_in and gw_out.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel on s390 architecture with the affected s390 crypto AES CTR or GCM code are relevant. The provided data does not identify affected kernel versions or configuration defaults.
What conditions are required for sensitive data to remain exposed?
The issue involves temporary buffers used during AES CTR processing of remaining data smaller than an AES block, plus AES GCM parameter and scatter-gather buffers on certain error paths. Exposure depends on those buffers not being scrubbed after use.
What should be done if immediate patching is not possible?
The provided fix is to explicitly scrub the temporary AES CTR buffer, the GCM CPACF parameter block, and GCM scatter-gather walk buffers, including on error paths. No alternative mitigation or workaround is provided.