---
id: CVE-2026-80546
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/zcrypt: Improve CCA CPRB length and overflow checks

  The xcrb_msg_to_type6cprb_msgx() function lacks proper input
  validation, creating security vulnerabilities:
  1.…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/zcrypt: Improve CCA CPRB length and overflow checks

  The xcrb_msg_to_type6cprb_msgx() function lacks proper input
  validation, creating security vulnerabilities:
  1.…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 20b0b0159390fa5c00a435195649680fefda81e0 <
    584400144020f40365de3972c4763da520e7280e
  - >-
    Linux >= e2c6d91eb8b1533753755f07803e47eceed263d0 <
    50fe5133dcb46449daf2435fa705264364411129
  - >-
    Linux >= e2c6d91eb8b1533753755f07803e47eceed263d0 <
    35ac6754ba6da45fd193f5ce3f665f7490b830d5
  - Linux 7.1
published: '2026-08-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:51.040'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80546'
references:
  - url: 'https://git.kernel.org/stable/c/35ac6754ba6da45fd193f5ce3f665f7490b830d5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/50fe5133dcb46449daf2435fa705264364411129'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/584400144020f40365de3972c4763da520e7280e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00183
epssPercentile: 0.0731
ingestedAt: '2026-10-15T11:00:41.667Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Improve CCA CPRB length and overflow checks

The xcrb_msg_to_type6cprb_msgx() function lacks proper input
validation, creating security vulnerabilities:
1. Integer overflow after CEIL4 alignment: Signed int variables could
   overflow during 4-byte boundary alignment, causing undersized
   buffer allocations or incorrect bounds checking.
2. Missing minimum size validation: The CPRBX structure is copied from
   userspace without verifying sufficient buffer length. Undersized
   buffers cause uninitialized memory access when reading structure
   fields like cprbx.cprb_len and cprbx.domain.
3. Arithmetic overflow in sum calculations: Adding control block and
   data block sizes could overflow, bypassing size checks and enabling
   buffer overflows.

Fix by using size_t for length calculations, adding U32_MAX boundary
checks after alignment, validating minimum control block size before
copying from userspace, and detecting sum calculation overflows.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.