Skip to main content

Linux Kernel CVE-2026-68451

| EUVDEUVD-2026-57920 HIGH
2026-08-13 Linux GHSA-4fv3-cqpg-5v3h
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only attack on IBM Z; PR:L because zcrypt device access requires group membership or explicit permission grant beyond default user.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:57 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 13, 2026 - 15:02 EUVD
CVE Published
Aug 13, 2026 - 13:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 13, 2026 - 13:59 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA ECC private key requests

cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

Articles & Coverage 1

News 4 New Linux Vulnerabilities - 4 High Severity Aug 14, 2026

AnalysisAI

Missing length validation in the Linux kernel's s390/zcrypt CCA ECC private key handler allows a local low-privileged user on IBM Z (s390) systems to trigger a buffer overread or overflow in the CPRB parameter block. The cca_ecc2protkey() function blindly trusts the length field embedded in a caller-supplied key token when computing how many bytes to copy into a fixed-size parameter block, enabling a crafted oversized token to corrupt adjacent kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is architecture-specific to IBM Z mainframe Linux deployments.

Technical ContextAI

The affected code resides in drivers/s390/crypto/zcrypt_ccamisc.c in the Linux kernel's zcrypt subsystem, which provides access to IBM Z hardware security modules via the Common Cryptographic Architecture (CCA) API. The cca_ecc2protkey() function constructs a Control Program Request Block (CPRB) to convert an ECC private key token into a protected key. The flaw is that the copy length is derived directly from the length field within the caller-controlled key token structure without first verifying it fits within the allocated CPRB parameter block buffer. This is an improper input validation pattern (analogous to CWE-20 or CWE-1284) that can lead to a heap or stack buffer overflow depending on buffer placement. The fix adds an early-exit check that rejects any token whose declared length exceeds the available space. CPE data confirms affected products are cpe:2.3:a:linux:linux:* across multiple stable branches.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.151 or later for the 6.6 branch, 6.12.103 or later for the 6.12 branch, 6.18.44 or later for the 6.18 branch, or 7.1.8 or later for the 7.1 branch. Patch commits are available at https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e, https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5, https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1, https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159, and https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730. As a compensating control on systems where immediate patching is not possible, restrict access to the zcrypt device nodes (typically under /dev/z90crypt or /dev/zcrypt) to only trusted system accounts and HSM management processes using Linux DAC permissions or SELinux/AppArmor policy. This mitigates the threat from unprivileged local users but has the trade-off of blocking legitimate cryptographic workloads for restricted processes.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68451 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy