CVE-2026-97590: Linux Kernel PAES Information Disclosure

CVE-2026-97590 Overview

CVE-2026-97590 is an information disclosure vulnerability in the Linux kernel's s390 architecture-specific cryptographic subsystem. The flaw resides in the Protected Key AES (PAES) algorithm implementation, where temporary buffers used during cryptographic operations were not properly scrubbed after use. The ctr_paes_do_crypt() function processed remaining bytes smaller than AES_BLOCK_SIZE in a buffer that was left uncleared, potentially exposing sensitive plaintext or key-derived material. A related issue in __xts_2keys_prep_param() cleared only the key field rather than the entire parameter block.

Critical Impact
Residual cryptographic data in uncleared kernel buffers may be exposed to subsequent operations on IBM Z (s390) systems using the PAES algorithm.

Affected Products

Linux kernel s390 architecture builds with PAES crypto support
arch/s390/crypto subsystem implementing CTR-PAES and XTS-PAES
Downstream distributions shipping affected kernel versions on IBM Z hardware

Discovery Timeline

2026-09-25 - CVE-2026-97590 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-97590

Vulnerability Analysis

The vulnerability affects the s390 kernel crypto driver that implements the Protected Key AES (PAES) algorithm. In counter (CTR) mode, when the input length is not a multiple of AES_BLOCK_SIZE (16 bytes), the implementation processes a trailing partial block using a stack or heap-resident temporary buffer. The original code did not zero this buffer when the function returned, leaving decrypted or encrypted data in kernel memory. Reuse of adjacent memory regions by later allocations could expose this residual data to kernel code paths that should not see it.

A secondary defect existed in __xts_2keys_prep_param(), which prepares the parameter block for XTS-PAES operations. The function previously scrubbed only the key field, leaving other sensitive fields in the parameter block intact. The patch extends the memset to cover the whole parameter block.

Root Cause

The root cause is incomplete memory sanitization of temporary cryptographic buffers [CWE-212, CWE-226]. Kernel crypto code must zero any buffer that transiently holds plaintext, keystream, or key material before relinquishing control. The affected functions omitted this step, treating stack-local or parameter-block memory as safe without an explicit scrub.

Attack Vector

Exploitation requires local access to an s390 system that performs cryptographic operations with the PAES algorithm. The vulnerability does not grant direct remote attack capability. A local attacker with the ability to trigger subsequent kernel allocations that reuse the uncleared memory region could potentially read fragments of prior cryptographic state. The NVD entry does not provide a CVSS score, and no public exploit is available.

The fix explicitly scrubs the temporary buffer at the end of ctr_paes_do_crypt() and expands the memset in __xts_2keys_prep_param() to clear the full parameter block. See the upstream commits 19a218b4, 7d1456d5, and d7159d21 for the authoritative patches.

Detection Methods for CVE-2026-97590

Indicators of Compromise

No runtime indicators are published for this flaw; successful information disclosure leaves no distinct log signature.
Kernel versions on s390 hardware predating the referenced upstream commits should be considered vulnerable.

Detection Strategies

Inventory IBM Z (s390/s390x) hosts and compare running kernel versions against distribution advisories citing the three listed commit hashes.
Audit kernel configuration (CONFIG_CRYPTO_PAES_S390) to identify systems where the PAES driver is loaded and reachable.
Review package management logs on affected distributions to confirm application of fixed kernel builds.

Monitoring Recommendations

Monitor kernel package upgrade status across s390 fleets using endpoint telemetry and configuration management tooling.
Track vendor security bulletins from Red Hat, SUSE, Ubuntu, and IBM for backported fixes referencing CVE-2026-97590.
Alert on unexpected loading or unloading of the paes_s390 kernel module in production workloads.

How to Mitigate CVE-2026-97590

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 19a218b4, 7d1456d5, and d7159d21 on all s390 systems.
Prioritize patching on hosts handling regulated data where PAES-protected keys process sensitive plaintext.
Restrict local shell access on affected IBM Z systems until patched kernels are deployed.

Patch Information

The fix is available in the upstream stable kernel tree. The patch set reworks ctr_paes_do_crypt() to explicitly zero the temporary partial-block buffer before returning, and updates __xts_2keys_prep_param() to clear the entire XTS parameter block rather than only the key field. Downstream distributions should backport the three commits listed in the external references.

Workarounds

Disable the PAES crypto module (paes_s390) where operationally feasible and fall back to software AES, accepting the performance tradeoff.
Limit local user access and enforce least-privilege policies on s390 systems that cannot be immediately patched.
Rotate any long-lived keys that may have been processed on unpatched systems once patches are applied.

bash

# Verify running kernel version and check for the paes_s390 module
uname -r
lsmod | grep paes_s390

# Unload the module as a temporary mitigation (requires no active users)
modprobe -r paes_s390