CVE-2026-80546: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80546 Overview

CVE-2026-80546 is a local privilege escalation vulnerability in the Linux kernel's s390/zcrypt driver. The flaw resides in the xcrb_msg_to_type6cprb_msgx() function, which handles Common Cryptographic Architecture (CCA) Cryptographic Parameter Request Block (CPRB) messages on IBM Z systems. The function lacks input validation, producing integer overflow conditions during 4-byte boundary alignment, missing minimum size checks before copying the CPRBX structure from user space, and arithmetic overflow when summing control and data block sizes. A local, authenticated attacker can trigger undersized buffer allocations, uninitialized memory access, and buffer overflows in kernel space.

Critical Impact

Local attackers with access to the zcrypt device interface can corrupt kernel memory, potentially leading to privilege escalation or system compromise on affected s390 systems.

Affected Products

• Linux kernel builds including the s390/zcrypt driver on IBM Z (s390x) architecture
• Systems exposing /dev/z90crypt or the CCA cryptographic coprocessor interface to unprivileged users
• Kernel versions prior to the fixes referenced in commits 35ac6754 and 50fe5133

Discovery Timeline

• 2026-08-26 - CVE-2026-80546 published to NVD
• 2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80546

Vulnerability Analysis

The xcrb_msg_to_type6cprb_msgx() function converts a user-supplied CCA CPRB message into a type-6 CPRB message consumed by the crypto coprocessor. The function suffers from three related input validation defects that combine into a memory corruption primitive.

First, signed int variables are used to align lengths to a 4-byte boundary using a CEIL4 macro. When user-controlled lengths approach INT_MAX, the alignment arithmetic overflows into a negative or truncated value. The resulting undersized allocation is then used as the target buffer size for subsequent copies.

Second, the driver copies the CPRBX header structure from user space without verifying that the source buffer meets the minimum size of the structure. Fields such as cprbx.cprb_len and cprbx.domain are then read from uninitialized or partially initialized kernel memory, producing unpredictable control-flow decisions.

Third, the sum of control block and data block sizes is computed without overflow detection. An attacker who supplies large individual lengths whose sum wraps around 32-bit arithmetic bypasses subsequent length checks and drives a buffer overflow in kernel space.

Root Cause

The root cause is improper input validation combined with integer overflow [CWE-190] and use of uninitialized memory [CWE-908]. The driver trusts length fields supplied through the ZSENDCPRB ioctl and performs arithmetic on them using signed 32-bit types before boundary and allocation checks.

Attack Vector

Exploitation requires local access and permission to open the zcrypt character device. An attacker crafts a malformed CCA CPRB payload with length fields designed to trigger alignment overflow, undersized structure copies, or sum wraparound. The malformed request is submitted through the standard zcrypt ioctl interface. Successful exploitation yields kernel memory corruption. No user interaction is required.

No public proof-of-concept exploit code is available. Technical details are described in the upstream kernel commits 35ac6754 and 50fe5133.

Detection Methods for CVE-2026-80546

Indicators of Compromise

• Unexpected kernel oops, panics, or BUG: messages referencing xcrb_msg_to_type6cprb_msgx or the zcrypt subsystem in dmesg and /var/log/messages.
• Non-root processes opening /dev/z90crypt or issuing ZSENDCPRB ioctls when no legitimate cryptographic workload is expected.
• KASAN reports indicating slab-out-of-bounds writes or use-of-uninitialized-value events in the zcrypt module.

Detection Strategies

• Audit which local users and services have read/write access to /dev/z90crypt and correlate with running processes.
• Enable kernel address sanitizer (KASAN) on test systems to surface bounds violations in the zcrypt CPRB path.
• Deploy auditd rules on ioctl syscalls targeting the zcrypt device and alert on invocations from unexpected UIDs.

Monitoring Recommendations

• Forward kernel logs to a centralized log platform and alert on faults originating in the zcrypt module.
• Track kernel package versions across the s390x fleet to identify hosts still running vulnerable builds.
• Baseline legitimate CCA workload processes so anomalous access to the crypto device triggers investigation.

How to Mitigate CVE-2026-80546

Immediate Actions Required

• Apply the upstream kernel patches from commits 35ac6754 and 50fe5133, or install vendor-provided kernel updates that incorporate them.
• Restrict permissions on /dev/z90crypt so only trusted service accounts can issue CPRB requests.
• Inventory IBM Z (s390x) hosts to confirm which systems load the zcrypt driver and prioritize patching.

Patch Information

The fix uses size_t for length calculations, adds U32_MAX boundary checks after CEIL4 alignment, validates the minimum CPRBX size before copying from user space, and detects sum-calculation overflows when combining control and data block lengths. Distribution kernels for Red Hat Enterprise Linux, SUSE Linux Enterprise Server, and Ubuntu on s390x should be updated to versions incorporating these commits.

Workarounds

• Unload the zcrypt kernel module on hosts that do not require hardware cryptographic acceleration.
• Tighten Linux capabilities and udev rules to prevent unprivileged users from opening the CCA device node.
• Use mandatory access controls (SELinux, AppArmor) to confine processes permitted to access /dev/z90crypt.

# Example: restrict zcrypt device access and blacklist the module where unused
chown root:crypto /dev/z90crypt
chmod 0660 /dev/z90crypt

# Blacklist the module on systems that do not use CCA coprocessors
echo "blacklist zcrypt" > /etc/modprobe.d/zcrypt-blacklist.conf
update-initramfs -u