CVE-2026-68385
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel on s390 architecture, there is a vulnerability in csum_partial() that on machines without vector facility calculates the checksum from address zero instead of the source buffer. This results in incorrect checksums.
Risk Assessment
This could lead to data corruption during network transmission or file operations, potentially resulting in integrity errors.
Recommendation
Apply a Linux kernel update containing the fix that passes the source to cksm() in the fallback path.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without vector facility Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. On machines without the vector facility, csum_copy() falls back to cksm(dst, ...), causing the checksum to be calculated from address zero instead of the source buffer. The VX implementation already checksums data loaded from src. Make the fallback do the same by passing src to cksm().