Buffer Exposure Vulnerability in Linux Kernel Affecting Zcrypt Components

CVE-2026-80543

What is CVE-2026-80543?

A vulnerability exists in the Linux kernel related to the s390/zcrypt functionality, where improper handling of message lengths can lead to the exposure of uninitialized kernel memory. Specifically, in the functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx(), user space messages are copied into a kernel buffer. If the size of the message is not correctly adjusted to a 4-byte format, it can result in the leakage of up to 3 bytes of sensitive kernel data to the crypto card firmware. This issue has been addressed with a patch that pads the kernel message buffer with zeros, preventing unintended information exposure during the cryptographic processing of messages.

References