---
id: CVE-2026-68451
title: 's390/zcrypt: Validate length for CCA ECC private key requests'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/zcrypt: Validate length for CCA ECC private key requests

  cca_ecc2protkey() derives the copy length for the CPRB parameter
  block directly from the length field in …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    7dc306ff7c4d951582adaae65e0aee9fb4968dbe
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    447a37a6bef11bfd3645069e380460b11386e2b9
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    f0831f13c42c1261d449dcee8a035e1c6cd9fcaa
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    013a4484f061a2b41f052e25c0015203287e63f1
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    8fa3e9435a13c335efb63fb4f4e77531a0031159
  - >-
    Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <
    a9ae0f6dd45c3ccc1d69363f7aea8af179122730
  - Linux 5.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:49:11.874669Z'
published: '2026-08-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:14.125Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68451'
references:
  - url: 'https://git.kernel.org/stable/c/7dc306ff7c4d951582adaae65e0aee9fb4968dbe'
  - url: 'https://git.kernel.org/stable/c/447a37a6bef11bfd3645069e380460b11386e2b9'
  - url: 'https://git.kernel.org/stable/c/f0831f13c42c1261d449dcee8a035e1c6cd9fcaa'
  - url: 'https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e'
  - url: 'https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5'
  - url: 'https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1'
  - url: 'https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159'
  - url: 'https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.02456
ingestedAt: '2026-10-16T17:24:46.869Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA ECC private key requests

cca_ecc2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.

## Affected

- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < 7dc306ff7c4d951582adaae65e0aee9fb4968dbe`
- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < 447a37a6bef11bfd3645069e380460b11386e2b9`
- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < f0831f13c42c1261d449dcee8a035e1c6cd9fcaa`
- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e`
- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5`
- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < 013a4484f061a2b41f052e25c0015203287e63f1`
- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < 8fa3e9435a13c335efb63fb4f4e77531a0031159`
- `Linux >= fa6999e326fe7851ecbd572b8cb9be8e930ebf41 < a9ae0f6dd45c3ccc1d69363f7aea8af179122730`
- `Linux 5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.