CVE-2026-64559: Linux Kernel Privilege Escalation Flaw

CVE-2026-64559 Overview

CVE-2026-64559 is a Linux kernel vulnerability in the s390/pkey subsystem. The flaw resides in the PKEY_VERIFYPROTK ioctl handler, which failed to validate the buffer length supplied in the user-space request structure. When the requested length exceeds the buffer size, the kernel processes memory beyond the intended boundary. The upstream fix explicitly checks the length and rejects requests where it exceeds the buffer size. The vulnerability affects IBM Z (s390x) systems that expose the protected-key cryptographic device interface to local users.

Critical Impact
A local user with access to the pkey character device on s390x can trigger an out-of-bounds memory access in kernel context, leading to disclosure of kernel memory, corruption, or denial of service.

Affected Products

Linux kernel builds on IBM s390x architecture exposing the s390/pkey driver
Distributions shipping affected kernel branches prior to commits 0a9e34c, 693bf91, 7e7e038, and b3d4ab2
Systems where the /dev/pkey device is accessible to unprivileged or semi-privileged users

Discovery Timeline

2026-07-29 - CVE-2026-64559 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64559

Vulnerability Analysis

The s390/pkey driver on IBM Z provides protected-key cryptographic services to user space through ioctl calls on /dev/pkey. The PKEY_VERIFYPROTK ioctl verifies a protected key by copying a request structure from user space and processing an embedded buffer described by a caller-supplied length field.

The handler dereferenced the caller-supplied length without confirming that it stayed within the bounds of the associated buffer. A local caller can set the length field to a value larger than the destination buffer and cause the kernel to read or process memory outside the intended region. The upstream commits add an explicit length check and return an error when the length exceeds the buffer size.

Because the flaw occurs in a kernel driver, the resulting memory access executes with kernel privileges. Depending on the exact code path and adjacent allocations, exploitation can leak sensitive kernel data, corrupt kernel structures, or crash the system.

Root Cause

The root cause is missing input validation on a user-controlled length field, a classic boundary condition error. The PKEY_VERIFYPROTK handler trusted the length embedded in the request structure and used it in a copy or processing operation without comparing it against the size of the target buffer. The condition maps to improper input validation and out-of-bounds access categories.

Attack Vector

Exploitation requires local access to an s390x system and permission to open /dev/pkey. An attacker crafts an ioctl payload for PKEY_VERIFYPROTK where the length field in the request structure exceeds the allocated buffer size. Submitting this ioctl drives the kernel into an out-of-bounds memory operation. No user interaction is required, and the attack does not traverse the network.

No public exploit is currently listed for CVE-2026-64559, and CISA KEV does not track it as exploited in the wild.

Detection Methods for CVE-2026-64559

Indicators of Compromise

Unexpected kernel oops, panic, or general protection fault messages referencing pkey_verifyprotk or the s390/pkey module in dmesg and /var/log/messages
Unprivileged processes opening /dev/pkey and issuing PKEY_VERIFYPROTK ioctls with unusually large length fields
Repeated crashes or restarts of services on IBM Z hosts that use protected-key cryptography

Detection Strategies

Audit ioctl syscalls against /dev/pkey with auditd rules and inspect the request codes and calling UIDs
Monitor kernel ring buffer output for stack traces originating in drivers/s390/crypto/pkey_api.c or related pkey modules
Baseline which processes legitimately use the pkey interface and alert on new or unexpected callers

Monitoring Recommendations

Forward s390x host kernel logs and audit records to a centralized log platform for correlation
Track kernel version and patch level across the IBM Z fleet to identify hosts still running unpatched builds
Alert on processes that combine local privilege escalation tooling with access to cryptographic device nodes

How to Mitigate CVE-2026-64559

Immediate Actions Required

Apply the vendor kernel update that includes commits 0a9e34c, 693bf91, 7e7e038, or b3d4ab2 to affected s390x hosts
Restrict access to /dev/pkey to trusted service accounts using file permissions, group membership, or device cgroup rules
Inventory IBM Z systems and prioritize multi-tenant or shared hosts where local users are present

Patch Information

The fix has been merged into the upstream Linux stable tree. Refer to Kernel Patch 0a9e34c, Kernel Patch 693bf91, Kernel Patch 7e7e038, and Kernel Patch b3d4ab2. Rebuild or upgrade distribution kernels that incorporate these commits and reboot into the patched kernel.

Workarounds

Remove or restrict the pkey module on hosts that do not require protected-key cryptography, for example by blacklisting it in /etc/modprobe.d/
Tighten permissions on /dev/pkey so only vetted service accounts can open the device
Limit local shell access on IBM Z systems and enforce least privilege for user accounts that interact with cryptographic devices

bash

# Configuration example: restrict /dev/pkey to a dedicated group
groupadd pkey-users
chown root:pkey-users /dev/pkey
chmod 0660 /dev/pkey

# Optional: prevent the module from loading on hosts that do not need it
echo 'blacklist pkey' > /etc/modprobe.d/disable-pkey.conf