EUVD-2026-50406
GHSA-qvg4-x45w-c5rj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local pkey-device access needed so AV:L/PR:L; vendor tag indicates confidentiality-dominant memory disclosure (C:H) with limited integrity/availability from the out-of-bounds access (I:L/A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size.
Articles & Coverage 1
AnalysisAI
Local information disclosure in the Linux kernel s390 protected-key (pkey) subsystem affects IBM Z (s390x) mainframe systems where the PKEY_VERIFYPROTK ioctl fails to validate the user-supplied buffer length before processing, allowing a local low-privileged user with access to the pkey device to trigger an out-of-bounds kernel memory access. Fixed by explicitly checking the request length against the buffer size and failing when it exceeds it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to an IBM Z / s390x system running an affected Linux kernel AND the ability to open the s390 pkey character device and invoke the PKEY_VERIFYPROTK ioctl; the specific trigger is supplying a length value in the ioctl request structure that exceeds the destination buffer size. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access and low privileges with no user interaction and full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local low-privileged user on an IBM Z Linux system that permits access to the pkey device opens it and issues a PKEY_VERIFYPROTK ioctl with a request structure declaring a length larger than the actual buffer, causing the kernel to read (or write) beyond the buffer bounds and potentially leak adjacent kernel memory contents back to user space. No public exploit is currently identified, and the attack requires prior local access to the affected mainframe. |
| Remediation | Apply the vendor-released kernel update for your stable branch - patched versions include 6.12.97, 6.18.40, and 7.1.5 (mainline 7.2-rc1) - by rebuilding or installing your distribution's kernel package containing the corresponding stable commit (e.g., 7e7e03848c918aa0acad5ffd75d929e3afec1554), referencing https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-64559. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Z (s390x) systems and determine which are running vulnerable Linux kernels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today