CVE-2026-64558: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64558 Overview

CVE-2026-64558 is a Linux kernel vulnerability in the s390 architecture-specific pkey subsystem. The flaw resides in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler failed to explicitly check the length of the target buffer before writing generated output data. When output data exceeds the caller-provided buffer size, an out-of-bounds write occurs in kernel memory.

The issue affects s390 (IBM Z / mainframe) Linux systems that expose the protected key interface to local users. Exploitation requires local access with low privileges and no user interaction.

Critical Impact
A local, low-privileged user on an s390 Linux system can trigger an out-of-bounds write in kernel memory through the pkey_pckmo handler, threatening kernel confidentiality, integrity, and availability.

Affected Products

Linux kernel s390/pkey subsystem on IBM Z (s390x) platforms
Distributions shipping affected upstream kernels prior to the stable fix commits
Systems exposing the /dev/pkey protected key interface to unprivileged users

Discovery Timeline

2026-07-29 - CVE-2026-64558 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64558

Vulnerability Analysis

The pkey subsystem on s390 provides an interface for converting clear or secure keys into protected keys usable by CPU acceleration instructions such as PCKMO (Perform Cryptographic Key Management Operation). The key_to_protkey() handler is the dispatch path that converts a caller-supplied key into a protected key and writes the result into a target buffer supplied by the caller.

In the pkey_pckmo implementation, the handler did not verify that the target buffer was large enough to hold the generated protected key output. Because the resulting protected key length depends on the key type derived from the input, the code path could produce more bytes than the destination buffer accommodates. The fix adds an explicit length check and causes the handler to fail cleanly when the output would exceed the buffer.

Exploitation is bound to the s390 architecture and requires the caller to reach the key_to_protkey() code path through the pkey ioctl or sysfs interface. Impact spans confidentiality, integrity, and availability, consistent with a kernel-space out-of-bounds write.

Root Cause

The root cause is a missing bounds check on the destination buffer inside the pkey_pckmo handler. The code assumed the output would fit without validating the declared target size, allowing writes beyond the intended buffer when the derived protected key size exceeded caller expectations. This is an Out-of-Bounds Write in kernel code paths reachable from userspace.

Attack Vector

The attack vector is local. A user with access to the pkey device interface issues a request that routes through key_to_protkey() and lands in the pkey_pckmo handler with a target buffer smaller than the produced output. Because the handler wrote unconditionally, the excess bytes corrupt adjacent kernel memory. The vulnerability is exploitable without user interaction beyond the attacker's own local session.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fixes in the Kernel Git Commit 02028a24, Kernel Git Commit 1ac287e2, Kernel Git Commit 433e5e70, and Kernel Git Commit 614aa049 for the exact code changes that introduce the length check.

Detection Methods for CVE-2026-64558

Indicators of Compromise

Unexpected kernel oops, panic, or BUG: messages referencing pkey, pkey_pckmo, or key_to_protkey in dmesg or /var/log/messages.
KASAN or slab corruption reports naming the pkey module on s390 hosts.
Unprivileged processes opening /dev/pkey and issuing pkey ioctls on systems where cryptographic tooling is not expected.

Detection Strategies

Audit systems for the running kernel version and confirm whether it includes the fix commits referenced in the upstream advisory.
Enable auditd rules on the pkey character device to record open and ioctl calls by non-cryptographic-service accounts.
Correlate kernel crash telemetry from s390 hosts with process ancestry to identify which user session preceded the fault.

Monitoring Recommendations

Ingest kernel logs and auditd events from s390 Linux hosts into a centralized analytics platform for continuous review.
Alert on repeated pkey ioctl failures returning -EINVAL or -ENOSPC, which may indicate probing for the buffer boundary condition.
Track kernel version inventory across the s390 fleet to prioritize hosts still running unpatched builds.

How to Mitigate CVE-2026-64558

Immediate Actions Required

Update the Linux kernel on all s390 systems to a stable release that incorporates the fix commits 02028a24, 1ac287e2, 433e5e70, and 614aa049.
Restrict access to /dev/pkey so that only trusted service accounts can invoke pkey ioctls until patches are deployed.
Reboot patched systems to activate the corrected kernel and verify the running version with uname -r.

Patch Information

The upstream Linux kernel adds an explicit length check to the pkey_pckmo implementation of key_to_protkey(). When the generated output would exceed the caller-supplied target buffer, the handler now fails rather than writing past the end of the buffer. Apply the vendor-provided kernel update from your distribution once it references the commits linked above. Backports are available in the stable trees identified in the Kernel Git Commit 02028a24 reference.

Workarounds

Unload or blacklist the pkey kernel module on s390 hosts that do not require protected key services.
Tighten file permissions on /dev/pkey so that only members of a dedicated group can open the device.
Constrain access with a mandatory access control policy (SELinux or AppArmor) that denies pkey ioctls from general-purpose user sessions.

bash

# Configuration example: restrict access to the pkey device until patched
chown root:pkeyusers /dev/pkey
chmod 0660 /dev/pkey

# Optional: blacklist the module on hosts that do not use protected keys
echo 'blacklist pkey' | sudo tee /etc/modprobe.d/blacklist-pkey.conf
sudo update-initramfs -u