Skip to main content

Linux Kernel CVE-2026-68452

| EUVDEUVD-2026-57921 HIGH
Classic Buffer Overflow (CWE-120)
2026-08-13 Linux GHSA-wcc3-pw65-4r46
Buffer Overflow Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-privilege access on IBM Z
  2. Delivery
    Craft key token with oversized length field
  3. Exploit
    Submit token via zcrypt device interface
  4. Execution
    cca_cipher2protkey() copies beyond CPRB buffer
  5. Persist
    Corrupt adjacent kernel memory
  6. Impact
    Escalate privileges to root

Vulnerability Assessment

Weakness
CWE
CWE-120
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local, low-privilege access to an IBM Z (s390) mainframe system running an unpatched Linux kernel version that contains the vulnerable cca_cipher2protkey() code. The attacker must have permissions to interact with the zcrypt device driver interface and submit CCA AES cipher key tokens - this is a local, non-networked code path that cannot be triggered remotely. Systems running any architecture other than IBM Z s390 are entirely unaffected. Key limiting factors: (1) physical or virtual login access to an IBM Z host is required; (2) the process must have read/write access to the zcrypt device node, which is typically restricted but accessible to low-privilege users in some configurations; (3) the vulnerability only exists in kernel versions after the introducing commit and before the patched stable releases. No special configuration flag or non-default feature enablement is described as required beyond having the zcrypt module loaded.
Impact

The CVSS 7.8 base score with AV:L/AC:L/PR:L/UI:N is internally consistent with the described vulnerability: a local user with low-privilege access to the zcrypt device can supply malformed input without requiring elevated rights, special timing, or user interaction. The full C:H/I:H/A:H impact triplet reflects the typical consequence of kernel memory corruption - potential privilege escalation to root. No EPSS data was provided, the vulnerability is not listed in CISA KEV, and no public PoC is referenced, suggesting exploitation is not yet widespread or automated; however, the low attack complexity means that once a working technique is developed, it requires no specialized conditions. The risk is architecturally bounded to IBM Z (s390) deployments, so the vast majority of organizations are entirely unaffected - but even a mid-sized municipal IT team in zabrze that operates IBM Z infrastructure for legacy workloads should treat this as urgent given the local privilege escalation potential. No conflicting signals between the CVSS vector and the description are identified.
Exploit ScenarioDerived

A local low-privileged user on an IBM Z (s390) system constructs a CCA AES cipher key token in which the internal length field is set to a value larger than the CPRB parameter block's allocated buffer size. When the user submits this token via the zcrypt device interface, cca_cipher2protkey() uses the attacker-controlled length to perform an oversized memory copy, corrupting kernel memory beyond the buffer boundary. Depending on what data occupies adjacent memory, the corruption could be leveraged to overwrite kernel control structures and achieve privilege escalation to root. No public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Kernel memory corruption in the Linux kernel's s390/zcrypt CCA AES cipher key handling path allows a local low-privileged user on IBM Z mainframe systems to trigger an out-of-bounds buffer operation with full confidentiality, integrity, and availability impact. The function cca_cipher2protkey() uses the length field from a user-supplied key token header to determine the copy size for the CPRB parameter block without validating it against the actual available buffer space, enabling adjacent kernel memory corruption. No public exploit exists and this is not in CISA KEV; vendor-released patches are available across multiple stable kernel branches including 6.6.151, 6.12.103, 6.18.44, and 7.1.8.

RemediationAI

The primary remediation is upgrading the Linux kernel to a patched stable release: 6.6.151, 6.12.103, or 6.18.44 for the respective 6.x LTS branches, 7.1.8 for the 7.1 branch, or any build from 7.2-rc6 onward. Patch commits are published on the kernel.org stable tree (see references). For systems that cannot be immediately patched, restrict access to the zcrypt device node (commonly /dev/z90crypt or equivalent under /dev/) to only trusted users and service accounts using filesystem permissions (chmod/chown) or mandatory access control policies (SELinux or AppArmor). This compensating control limits the set of principals able to supply malicious key token data; the trade-off is that it blocks hardware cryptographic acceleration for restricted users, which may affect workload performance. A more disruptive mitigation is to unload the zcrypt kernel module entirely (rmmod zcrypt), which eliminates the attack surface but disables all CCA and EP11 hardware crypto operations on the system. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-68452.

Affected VersionsENISA

Linux patch: 6.18.44
Linux 5.4
Linux 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <06afe425d5283b9764303de47f554da5a808ce8a
Linux patch: 7.1.8
Linux patch: 6.6.151
Linux patch: 6.12.103
Linux 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <406b317ea2b501f6f5eca1264293c9399a73a778
Linux 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <4fc46deceda076d429ef3fab2ccf8d96629ebd23
Linux patch: 0
Linux 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <ad93a1f1a45652478c0cf4eb029114e03af57f3b
Linux 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd <3859f630b674801a00bca39bc451f52288591f65
Linux patch: 7.2-rc6

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code resides in the s390 (IBM mainframe) zcrypt subsystem of the Linux kernel, which provides the kernel-side interface to IBM Z cryptographic hardware coprocessors using the CCA (Common Cryptographic Architecture) protocol. The function cca_cipher2protkey() constructs a CPRB (Control Program Request Block) - a fixed-size structure passed to the hardware - and uses the length field embedded within the supplied CCA AES cipher key token to determine how many bytes to copy into the CPRB parameter block area. Because this length is sourced from user-controlled input without prior bounds checking against the actual allocated buffer size, a crafted token can cause the copy to exceed the buffer boundary, corrupting adjacent kernel memory. CWE is unassigned in NVD, but the root cause class is clearly insufficient input validation before a length-controlled memory operation (analogous to CWE-119/CWE-129). CPE data (cpe:2.3:a:linux:linux) confirms this is a mainline Linux kernel issue, introduced at commit 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local-only vector confirmed by zcrypt device interface requirement; low-privilege zcrypt access sufficient; kernel memory corruption yields full CIA impact with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 13, 2026 - 15:02 EUVD
CVE Published
Aug 13, 2026 - 13:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 13, 2026 - 13:59 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA AES cipher key requests

cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

Articles & Coverage 1

News 4 New Linux Vulnerabilities - 4 High Severity Aug 14, 2026

Executive ViewAI

Why It Matters

A kernel memory corruption vulnerability (CVE-2026-68452, CVSS 7.8) in the Linux kernel's s390/zcrypt CCA AES cipher implementation affects IBM Z mainframe systems. The vulnerability requires local authentication but allows low-privileged users to corrupt kernel memory with full data confidentiality, integrity, and availability impact. Currently without known active exploitation, the risk is material for Z mainframe operators; vendor patches are available and deployment is recommended immediately.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Low
niche IBM Z mainframe architecture, very limited enterprise footprint
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-68452 ADVISORY https://ubuntu.com/security/notices/USN-8876-1 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/389487 REF https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a REF https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65 REF https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778 REF https://git.kernel.org/stable/c/4e500ecb6704d879f9c2417c2ed6faba595015ca REF https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23 REF https://git.kernel.org/stable/c/7f9e5a3dbb14a9b321a1dfa30390402c673f82dc REF https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b REF https://git.kernel.org/stable/c/be037204e4f595e4bd2159acda146677a1dc6342

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy