UBUNTU-CVE-2026-68453: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken() functions. Additionally check in ccagencipherkey() for possible underflow with returned key size. The CCA token structures contain user-controlled len fields that were used in operations without proper validation against both the actual buffer size and minimum token structure size. An attacker could set this field larger than the actual buffer size, leading to reading beyond buffer boundaries. This may result in a kernel crash or exposure of memory via sending this as part of a request down to the crypto card. Also an attacker could have used a very small len value and thus enforce a buffer under-run which may produce similar effects as a over-read. So now a key must - key buf length must be at least sizeof the token struct - the key len field inside the token must fit into the range of sizeof key token struct ... key buf length
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cca_gencipherkey() and all cca_check_sec*token() functions, validate the actual key buffer size and every user-controlled token length field before use: require the key buffer length to be at least sizeof the token structure, and require the token's key length to fit within the token structure size and actual buffer bounds.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The affected software list consists of Ubuntu Linux kernel packages, including linux, linux-azure, linux-gcp, linux-fips, linux-aws-fips, their Azure and GCP FIPS variants, and linux-realtime. Exploitation concerns the s390 zcrypt CCA key-token handling path and requests sent to a crypto card.
What access does an attacker need to exploit it?
The severity vector indicates local access with low attack complexity and low privileges required, with no user interaction. The attacker must be able to provide a crafted CCA token whose user-controlled length field does not match the actual key buffer or minimum token structure size.
What could exploitation cause?
Malformed token lengths can cause kernel buffer over-reads or under-runs. The stated outcomes include a kernel crash or exposure of memory when the malformed data is sent as part of a request to the crypto card.
What validation is included in the fix?
The fix validates the actual key-buffer size and token-length fields in the cca_check_sec*token() functions. It also checks for a returned-key-size underflow in cca_gencipherkey(), requiring the buffer to be at least the token structure size and the token length to remain within the structure-to-buffer range.