CVE-2026-80544: Linux Kernel EP11 CPRB Information Disclosure

CVE-2026-80544 Overview

CVE-2026-80544 is a Linux kernel vulnerability in the s390/zcrypt driver affecting EP11 Cryptographic Program Request Block (CPRB) domain handling. The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access the domain field in the EP11 CPRB payload without validating the actual ASN.1 encoding. This bypasses proper Abstract Syntax Notation One (ASN.1) validation and lacks bounds checking during payload parsing. The flaw affects s390 architecture systems running the Linux kernel with IBM cryptographic coprocessor support.

Critical Impact
Local authenticated attackers with access to the zcrypt device interface can trigger memory corruption through malformed EP11 CPRB payloads, impacting confidentiality, integrity, and availability of the affected system.

Affected Products

Linux kernel s390/zcrypt driver on IBM System z (s390) architecture
Systems using IBM EP11 cryptographic coprocessors via zcrypt
Kernel versions prior to the fix commits 0864a16 and db21b2c

Discovery Timeline

2026-08-26 - CVE-2026-80544 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80544

Vulnerability Analysis

The vulnerability resides in the zcrypt_msgtype6_send_ep11_cprb() function within the s390/zcrypt subsystem. This function processes EP11 CPRB payloads sent from userspace to IBM cryptographic coprocessors on s390 hardware. The original implementation used struct overlay techniques via a pld_hdr structure to access and modify the domain field embedded in the ASN.1-encoded payload.

The struct overlay approach assumes a fixed payload structure. It does not validate that the incoming buffer actually conforms to the expected ASN.1 encoding. The length format detection logic contains complex branching that fails to properly enforce bounds at each parsing step. Direct struct member access bypasses ASN.1 tag and length validation entirely.

This pattern maps to input validation weaknesses [CWE-20] combined with improper bounds checking [CWE-125]. An attacker with local access to the zcrypt device interface can craft a payload that misleads the parser about field boundaries.

Root Cause

The root cause is the use of fixed struct overlays instead of explicit protocol parsing. The kernel code trusts that userspace-supplied payloads match the layout described by pld_hdr. When the actual ASN.1 encoding differs from that assumed layout, the code reads and writes at offsets that do not correspond to legitimate protocol fields.

Attack Vector

An attacker requires local access with permissions to open the zcrypt device node and issue ioctl calls that transmit EP11 CPRBs. The attacker submits a crafted CPRB with a malformed ASN.1 payload. The kernel parses the payload using struct overlays without validating tag or length fields. This can trigger out-of-bounds memory access affecting kernel memory integrity.

No public proof-of-concept exploit is available. Consult the Linux Kernel Commit Log for the patch details describing the ASN.1 parsing rework.

Detection Methods for CVE-2026-80544

Indicators of Compromise

Unexpected kernel crashes or oops messages referencing zcrypt_msgtype6_send_ep11_cprb in dmesg output
Anomalous ioctl activity from non-privileged processes targeting /dev/z90crypt or related zcrypt device nodes
Unusual EP11 CPRB traffic patterns from user sessions that do not normally use cryptographic coprocessors

Detection Strategies

Audit kernel version strings on s390 systems and flag hosts running kernels prior to the fix commits
Monitor kernel logs for warnings, oops messages, or panics that name the s390/zcrypt driver
Track processes invoking ioctls on zcrypt device nodes and correlate with expected cryptographic workloads

Monitoring Recommendations

Enable kernel audit rules for open and ioctl syscalls against zcrypt device paths
Forward dmesg and /var/log/messages to a centralized log platform for anomaly detection
Alert on repeated failures or crashes involving cryptographic coprocessor request handling

How to Mitigate CVE-2026-80544

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 0864a163783bff109b548266921829ea794edc93 and db21b2cf6dd0af5ffd08931e0a9fcda5a0473220
Inventory s390 systems using IBM cryptographic coprocessors and prioritize patching those hosts
Restrict access to zcrypt device nodes to trusted service accounts and cryptographic workloads only

Patch Information

The fix replaces struct overlays with explicit ASN.1 parsing that validates each field, including payload tag and length, function tag and length, and the optional domain tag and length. An asn1_int_encode() helper is added to safely write integer values with correct endianness. The patched code performs bounds checking at every parsing step. See the upstream commits 0864a16 and db21b2c for the full patch.

Workarounds

Tighten file permissions on /dev/z90crypt and related zcrypt device nodes to limit local access
Disable the zcrypt kernel module on s390 systems that do not require IBM cryptographic coprocessor functionality
Constrain container and virtual machine access to s390 crypto devices using seccomp or device cgroup policies

bash

# Restrict access to zcrypt device nodes
chown root:crypto /dev/z90crypt
chmod 660 /dev/z90crypt

# Verify kernel version on s390 hosts
uname -r

# Unload the zcrypt module if not required
modprobe -r zcrypt