Skip to main content

Linux Kernel CVE-2026-68451

| EUVDEUVD-2026-57920 HIGH
Classic Buffer Overflow (CWE-120)
2026-08-13 Linux GHSA-4fv3-cqpg-5v3h
Buffer Overflow Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell on IBM Z Linux host
  2. Delivery
    Verify access to zcrypt device node
  3. Exploit
    Craft ECC key token with oversized length field
  4. Execution
    Invoke CCA ECC protected-key conversion syscall
  5. Persist
    Trigger out-of-bounds write in kernel CPRB buffer
  6. Impact
    Corrupt kernel heap to escalate to root

Vulnerability Assessment

Weakness
CWE
CWE-120
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) the target system runs Linux on IBM Z (s390/s390x) hardware - this code path does not execute on x86, ARM, or other architectures; (2) the attacker has a local shell with at least low-privileged access (PR:L per CVSS); (3) the attacker has read/write access to the zcrypt device node, which is typically restricted to users in the 'zcrypt' group or with specific DAC/MAC permissions. No network access is required. Exploitation is limited by the requirement for IBM Z hardware, local authenticated access, and zcrypt device permissions. These factors collectively reduce realistic exposure to insider threats or compromised accounts in mainframe environments, not opportunistic remote attackers.
Impact

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic local privilege escalation scenario: an attacker needs only a shell and low-privilege access to the zcrypt device to attempt exploitation, with no user interaction or complex conditions required. However, the real-world exploitability is significantly constrained by architecture: this code path executes exclusively on IBM Z (s390/s390x) hardware, limiting the affected population to enterprise mainframe environments. No EPSS data was supplied, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation. The high C/I/A impact metrics are plausible if kernel memory corruption is achieved - kernel-level writes could yield privilege escalation to root - but exploitation reliability will depend on heap layout and kernel hardening features (KASLR, SMAP/SMEP equivalents on z/Architecture). The gap between the high CVSS score and absence of KEV/POC is consistent with a vulnerability that is theoretically severe but practically difficult to weaponize reliably in hardened enterprise mainframe deployments.
Exploit ScenarioDerived

A local attacker with a shell account and access to the zcrypt character device on an IBM Z Linux system constructs a crafted ECC key token with a length field set to a value larger than the CPRB parameter block buffer. By calling the CCA ECC key-to-protected-key conversion interface with this malformed token, the kernel copies beyond the buffer boundary, corrupting adjacent kernel heap memory. With sufficient control over the corrupted data, the attacker may overwrite kernel function pointers or security-critical data structures to escalate privileges to root. No public proof-of-concept exists at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Missing length validation in the Linux kernel's s390/zcrypt CCA ECC private key handler allows a local low-privileged user on IBM Z (s390) systems to trigger a buffer overread or overflow in the CPRB parameter block. The cca_ecc2protkey() function blindly trusts the length field embedded in a caller-supplied key token when computing how many bytes to copy into a fixed-size parameter block, enabling a crafted oversized token to corrupt adjacent kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is architecture-specific to IBM Z mainframe Linux deployments.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.151 or later for the 6.6 branch, 6.12.103 or later for the 6.12 branch, 6.18.44 or later for the 6.18 branch, or 7.1.8 or later for the 7.1 branch. Patch commits are available at https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e, https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5, https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1, https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159, and https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730. As a compensating control on systems where immediate patching is not possible, restrict access to the zcrypt device nodes (typically under /dev/z90crypt or /dev/zcrypt) to only trusted system accounts and HSM management processes using Linux DAC permissions or SELinux/AppArmor policy. This mitigates the threat from unprivileged local users but has the trade-off of blocking legitimate cryptographic workloads for restricted processes.

Affected VersionsENISA

Linux patch: 0
Linux patch: 6.6.151
Linux patch: 7.2-rc6
Linux patch: 6.12.103
Linux fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <a9ae0f6dd45c3ccc1d69363f7aea8af179122730
Linux fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <8fa3e9435a13c335efb63fb4f4e77531a0031159
Linux fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5
Linux patch: 7.1.8
Linux fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <013a4484f061a2b41f052e25c0015203287e63f1
Linux fa6999e326fe7851ecbd572b8cb9be8e930ebf41 <dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e
Linux 5.10
Linux patch: 6.18.44

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code resides in drivers/s390/crypto/zcrypt_ccamisc.c in the Linux kernel's zcrypt subsystem, which provides access to IBM Z hardware security modules via the Common Cryptographic Architecture (CCA) API. The cca_ecc2protkey() function constructs a Control Program Request Block (CPRB) to convert an ECC private key token into a protected key. The flaw is that the copy length is derived directly from the length field within the caller-controlled key token structure without first verifying it fits within the allocated CPRB parameter block buffer. This is an improper input validation pattern (analogous to CWE-20 or CWE-1284) that can lead to a heap or stack buffer overflow depending on buffer placement. The fix adds an early-exit check that rejects any token whose declared length exceeds the available space. CPE data confirms affected products are cpe:2.3:a:linux:linux:* across multiple stable branches.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local-only attack on IBM Z; PR:L because zcrypt device access requires group membership or explicit permission grant beyond default user.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 13, 2026 - 15:02 EUVD
CVE Published
Aug 13, 2026 - 13:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 13, 2026 - 13:59 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA ECC private key requests

cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

Articles & Coverage 1

News 4 New Linux Vulnerabilities - 4 High Severity Aug 14, 2026

Executive ViewAI

Why It Matters

A validation flaw in the Linux kernel's s390/zcrypt cryptographic subsystem allows local users on IBM Z systems to trigger memory corruption through oversized token attacks. Organizations running Linux on IBM Z mainframes must apply this patch immediately to prevent system instability and ensure the integrity of cryptographic operations.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Low
IBM Z mainframe Linux, enterprise-only architecture footprint
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-68451 ADVISORY https://ubuntu.com/security/notices/USN-8876-1 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/389486 REF https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1 REF https://git.kernel.org/stable/c/447a37a6bef11bfd3645069e380460b11386e2b9 REF https://git.kernel.org/stable/c/7dc306ff7c4d951582adaae65e0aee9fb4968dbe REF https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159 REF https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730 REF https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e REF https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5 REF https://git.kernel.org/stable/c/f0831f13c42c1261d449dcee8a035e1c6cd9fcaa

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy