CVE-2026-80543: Linux Kernel Information Disclosure Vulnerability

CVE-2026-80543 Overview

CVE-2026-80543 is an uninitialized memory use vulnerability in the Linux kernel's s390/zcrypt driver. The flaw resides in the xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() functions, which handle Common Cryptographic Architecture (CCA) and Enterprise PKCS#11 (EP11) message processing on IBM Z (s390) systems. These functions copy user space messages into a kernel buffer based on the caller-supplied length. Subsequent processing requires a 4-byte aligned buffer, leaving up to 3 bytes of uninitialized kernel memory in the transmission path. This residual memory is forwarded to the crypto card firmware, potentially exposing kernel memory contents.

Critical Impact
Up to 3 bytes of uninitialized kernel memory can be forwarded to IBM Z crypto card firmware per request, enabling potential disclosure of sensitive kernel data.

Affected Products

Linux kernel s390/zcrypt driver on IBM Z architecture
Systems using CCA cryptographic coprocessor interfaces
Systems using EP11 cryptographic coprocessor interfaces

Discovery Timeline

2026-08-26 - CVE-2026-80543 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80543

Vulnerability Analysis

The vulnerability affects the IBM Z cryptographic device driver (zcrypt), which mediates access to hardware crypto coprocessors from user space. When applications issue CCA or EP11 requests, the kernel functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() allocate a kernel buffer and copy user-supplied message data into it.

The downstream processing pipeline expects the message length to be aligned to a 4-byte boundary. When the user-provided message length is not a multiple of four, the allocated buffer is larger than the copied payload. The trailing bytes between the end of the copied data and the aligned buffer boundary retain whatever content was previously stored at that memory location.

The unpadded buffer is then forwarded through the driver stack and ultimately transmitted to the crypto card firmware. This constitutes an information disclosure primitive that leaks kernel heap contents to a hardware component outside the kernel trust boundary.

Root Cause

The root cause is missing initialization of the tail portion of the kernel buffer after the user copy operation. The code copies exactly msg_length bytes from user space but transmits an aligned length, without zeroing the gap. This falls under uninitialized memory use, closely related to [CWE-908].

Attack Vector

Exploitation requires local access to the s390 system and permissions to invoke ioctl operations on the zcrypt device. A local user submits a crafted CCA or EP11 request with a message length that is not 4-byte aligned. The resulting request leaks up to 3 bytes of kernel memory per call to the crypto firmware. Repeated calls could expose larger volumes of kernel memory to any adversary able to observe firmware-side telemetry or to a compromised or malicious hardware peripheral.

The vulnerability described in the upstream commits does not present a synthetic proof-of-concept. See the Kernel Git Commit 2db92a56 and Kernel Git Commit eb363254 for the authoritative patches.

Detection Methods for CVE-2026-80543

Indicators of Compromise

Unusual volumes of ioctl calls against /dev/z90crypt or related zcrypt device nodes from non-cryptographic workloads
CCA or EP11 requests submitted with message lengths that are not multiples of four
Unexpected user-space processes interacting with the zcrypt subsystem on IBM Z hosts

Detection Strategies

Audit kernel version and confirm whether the patches from commits 2db92a56 and eb363254 are applied on all IBM Z Linux instances
Enable Linux Audit rules on zcrypt device nodes to record process, UID, and ioctl command codes
Correlate zcrypt ioctl activity with process lineage to identify unauthorized cryptographic API consumers

Monitoring Recommendations

Track the kernel package version inventory across all s390x hosts and flag systems running vulnerable builds
Monitor for privilege changes on accounts with access to the zcrypt device node
Alert on new binaries invoking ioctl against zcrypt devices outside sanctioned crypto workloads

How to Mitigate CVE-2026-80543

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 2db92a56 and eb363254 to all affected s390x systems
Rebuild and redeploy custom kernels that include the s390/zcrypt driver to include the padding fix
Restrict access to the zcrypt device node to trusted users and service accounts through file permissions and Linux capabilities

Patch Information

The fix pads the trailing bytes between the user-copied message and the 4-byte aligned buffer length with zeros before the buffer is forwarded to downstream processing and the crypto card firmware. Apply distribution-supplied kernel updates that incorporate Kernel Git Commit 2db92a56 and Kernel Git Commit eb363254.

Workarounds

Restrict access permissions on the zcrypt character device to prevent untrusted users from issuing CCA or EP11 requests
Where feasible, disable the zcrypt module on s390 systems that do not require hardware crypto acceleration
Enforce mandatory access control policies (SELinux or AppArmor) to limit which processes can invoke zcrypt ioctls

bash

# Configuration example: restrict access to zcrypt device
chown root:crypto /dev/z90crypt
chmod 0660 /dev/z90crypt

# Verify installed kernel version against patched builds
uname -r
rpm -q kernel   # RHEL / SLES
dpkg -l | grep linux-image   # Debian / Ubuntu