CVE-2026-80709: Linux Kernel s390/zcrypt Privilege Escalation

CVE-2026-80709 Overview

CVE-2026-80709 is a Linux kernel vulnerability in the s390/zcrypt driver affecting IBM Z (s390) architecture crypto card support. The flaw resides in the domain value verification path when an EP11 (Enterprise PKCS #11) CPRB (Cryptographic Programming Request Block) is prepared for transmission to a crypto card. An incorrect upper limit check permits access to heap memory beyond the perms->adm array when an administrative CPRB is issued through a custom device node. The issue is local, requires low privileges, and impacts confidentiality, integrity, and availability of the kernel.

Critical Impact
A local low-privileged user with access to a custom zcrypt device node can trigger out-of-bounds heap reads and potentially corrupt kernel memory when submitting crafted EP11 administrative CPRBs.

Affected Products

Linux kernel s390/zcrypt driver on IBM Z (s390x) systems
Kernel branches referenced by upstream stable commits 1223477c, 13e53d6a, 4589f742, 672b1294, 983279d7, and b505dcc8
Distributions shipping s390x kernels with EP11 crypto support that have not backported the fix

Discovery Timeline

2026-08-28 - CVE-2026-80709 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80709

Vulnerability Analysis

The s390/zcrypt subsystem exposes IBM Z Hardware Security Modules (HSMs) to userspace. When processing an EP11 CPRB destined for a specific crypto domain, the driver validates the requested domain identifier against an upper limit. The check compares the domain value against an incorrect bound rather than the architectural maximum of AP_DOMAINS (256). The undersized or otherwise incorrect comparison lets domain values pass validation that should be rejected.

Because administrative CPRB handling indexes the perms->adm bitmap using the attacker-supplied domain value, an out-of-bounds access into adjacent heap memory occurs. This is an out-of-bounds read/write on kernel heap memory adjacent to the permissions structure, classified as an [CWE-125] out-of-bounds read and [CWE-787] out-of-bounds write pattern.

The defective check is only reachable through custom (non-default) zcrypt device nodes. Systems that expose such nodes to unprivileged or semi-privileged users are directly exposed. The upstream fix adds the correct AP_DOMAINS = 256 boundary check to the domain validation path.

Root Cause

The root cause is improper input validation of the domain field in EP11 CPRB requests. The original comparison used a wrong upper limit, allowing indices to exceed the size of the perms->adm administrative permissions array. Any code path that later dereferences the array with the unchecked index reads or writes memory outside the intended allocation.

Attack Vector

Exploitation is local. An attacker with access to a custom zcrypt device node crafts an EP11 administrative CPRB with a domain value that bypasses the flawed check but still indexes memory beyond perms->adm. Submitting the CPRB through the standard ioctl interface triggers the kernel to touch out-of-bounds heap memory. Impact ranges from information disclosure of adjacent kernel heap contents to memory corruption depending on the surrounding allocator layout.

No public proof-of-concept is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-80709

Indicators of Compromise

Unexpected ioctl activity from non-administrative accounts against /dev/zcrypt* or custom zcrypt device nodes.
Kernel log entries referencing zcrypt, ep11, or KASAN out-of-bounds reports pointing into the perms->adm region.
Crashes, oopses, or panics on s390x hosts correlated with EP11 CPRB submission.

Detection Strategies

Enable KASAN or SLUB debug on test kernels to surface out-of-bounds accesses in zcrypt code paths during triage.
Audit open() and ioctl() syscalls against custom zcrypt device nodes using auditd rules to detect unusual callers.
Review udev rules and device permissions to identify any non-default zcrypt nodes exposed to unprivileged users.

Monitoring Recommendations

Forward kernel ring buffer (dmesg) and auditd events from s390x hosts to a central logging platform for correlation.
Alert on kernel oops or BUG messages containing zcrypt, ap_bus, or ep11 symbols.
Track process-level use of s390 crypto interfaces and baseline expected administrative CPRB traffic per host.

How to Mitigate CVE-2026-80709

Immediate Actions Required

Apply distribution kernel updates that incorporate the upstream s390/zcrypt fix as soon as they are released.
Restrict access to zcrypt device nodes to trusted administrators only, and remove any custom device nodes that are not required.
Inventory s390x systems using EP11 CPRB workloads and prioritize patching hosts that expose crypto devices to multi-tenant workloads.

Patch Information

The fix adds the correct AP_DOMAINS = 256 upper limit check to domain validation in the EP11 CPRB processing path. It has been merged upstream and backported across stable branches. Refer to the upstream commits: Linux Kernel Commit 1223477c, Linux Kernel Commit 13e53d6a, Linux Kernel Commit 4589f742, Linux Kernel Commit 672b1294, Linux Kernel Commit 983279d7, and Linux Kernel Commit b505dcc8.

Workarounds

Remove or gate access to custom zcrypt device nodes, since the vulnerable code path is only reachable through them.
Restrict /dev/zcrypt* device permissions to a dedicated crypto administration group using udev rules.
Where feasible, disable EP11 CPRB administrative workflows on hosts that do not require them until the patch is applied.

bash

# Example udev rule to restrict zcrypt device access to a crypto-admin group
# /etc/udev/rules.d/99-zcrypt.rules
KERNEL=="zcrypt*", GROUP="cryptoadm", MODE="0660"

# Verify current kernel version on s390x hosts
uname -r

# List currently exposed zcrypt device nodes
ls -l /dev/zcrypt* /dev/z90crypt 2>/dev/null