---
id: CVE-2026-68453
title: 's390/zcrypt: Fix buffer over-read in cca_cipher2protkey'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

  Add validation of both the actual key buffer size and token length
  fields in all the cca_check_sec*token() func…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    a57fd7fcdb63e2d5ceac78bbe825ec986062a9da
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    3b2abee2a678607ae27975bc6833785c2002df43
  - >-
    Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <
    36b230835b8a008266aad22168ca52afacc8a58d
  - Linux 5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:49:20.171287Z'
published: '2026-08-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:14.418Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68453'
references:
  - url: 'https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da'
  - url: 'https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43'
  - url: 'https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02095
ingestedAt: '2026-10-16T17:24:46.870Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

Add validation of both the actual key buffer size and token length
fields in all the cca_check_sec*token() functions. Additionally check
in cca_gencipherkey() for possible underflow with returned key size.

The CCA token structures contain user-controlled len fields that
were used in operations without proper validation against both the
actual buffer size and minimum token structure size. An attacker
could set this field larger than the actual buffer size, leading to
reading beyond buffer boundaries. This may result in a kernel crash or
exposure of memory via sending this as part of a request down to the
crypto card. Also an attacker could have used a very small len value
and thus enforce a buffer under-run which may produce similar effects
as a over-read.

So now a key must
- key buf length must be at least sizeof the token struct
- the key len field inside the token must fit into the range of
  sizeof key token struct ... key buf length

## Affected

- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < a57fd7fcdb63e2d5ceac78bbe825ec986062a9da`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 3b2abee2a678607ae27975bc6833785c2002df43`
- `Linux >= 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd < 36b230835b8a008266aad22168ca52afacc8a58d`
- `Linux 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.