---
id: CVE-2026-68452
title: 's390/zcrypt: Validate length for CCA AES cipher key requests'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/zcrypt: Validate length for CCA AES cipher key requests

  cca_cipher2protkey() derives the copy length for the CPRB parameter
  block directly from the length field i…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    be037204e4f595e4bd2159acda146677a1dc6342
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    4e500ecb6704d879f9c2417c2ed6faba595015ca
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    7f9e5a3dbb14a9b321a1dfa30390402c673f82dc
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    406b317ea2b501f6f5eca1264293c9399a73a778
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    4fc46deceda076d429ef3fab2ccf8d96629ebd23
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    ad93a1f1a45652478c0cf4eb029114e03af57f3b
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    3859f630b674801a00bca39bc451f52288591f65
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    06afe425d5283b9764303de47f554da5a808ce8a
  - Linux 5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:49:15.916334Z'
published: '2026-08-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:14.276Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68452'
references:
  - url: 'https://git.kernel.org/stable/c/be037204e4f595e4bd2159acda146677a1dc6342'
  - url: 'https://git.kernel.org/stable/c/4e500ecb6704d879f9c2417c2ed6faba595015ca'
  - url: 'https://git.kernel.org/stable/c/7f9e5a3dbb14a9b321a1dfa30390402c673f82dc'
  - url: 'https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778'
  - url: 'https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23'
  - url: 'https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b'
  - url: 'https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65'
  - url: 'https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02265
ingestedAt: '2026-10-16T17:24:46.867Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA AES cipher key requests

cca_cipher2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.

## Affected

- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < be037204e4f595e4bd2159acda146677a1dc6342`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 4e500ecb6704d879f9c2417c2ed6faba595015ca`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 7f9e5a3dbb14a9b321a1dfa30390402c673f82dc`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 406b317ea2b501f6f5eca1264293c9399a73a778`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 4fc46deceda076d429ef3fab2ccf8d96629ebd23`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < ad93a1f1a45652478c0cf4eb029114e03af57f3b`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 3859f630b674801a00bca39bc451f52288591f65`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 06afe425d5283b9764303de47f554da5a808ce8a`
- `Linux 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.