CVE-2026-68452
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, in the s390/zcrypt subsystem, a missing length validation was found in CCA AES cipher key requests. cca_cipher2protkey() derives the copy length from the key token length field, which could lead to out-of-bounds read if the token length exceeds the available space in the CPRB parameter block.
Risk Assessment
Lack of validation could allow an attacker to trigger an out-of-bounds read, potentially causing system crash or information disclosure.
Recommendation
Apply the fix that rejects the request if the token length exceeds the available space in the parameter block, and update the kernel to a patched version.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.