Skip to main content

Linux Kernel CVE-2026-68452

| EUVDEUVD-2026-57921 HIGH
2026-08-13 Linux GHSA-wcc3-pw65-4r46
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only vector confirmed by zcrypt device interface requirement; low-privilege zcrypt access sufficient; kernel memory corruption yields full CIA impact with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:40 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 13, 2026 - 15:02 EUVD
CVE Published
Aug 13, 2026 - 13:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 13, 2026 - 13:59 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA AES cipher key requests

cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

Articles & Coverage 1

News 4 New Linux Vulnerabilities - 4 High Severity Aug 14, 2026

AnalysisAI

Kernel memory corruption in the Linux kernel's s390/zcrypt CCA AES cipher key handling path allows a local low-privileged user on IBM Z mainframe systems to trigger an out-of-bounds buffer operation with full confidentiality, integrity, and availability impact. The function cca_cipher2protkey() uses the length field from a user-supplied key token header to determine the copy size for the CPRB parameter block without validating it against the actual available buffer space, enabling adjacent kernel memory corruption. No public exploit exists and this is not in CISA KEV; vendor-released patches are available across multiple stable kernel branches including 6.6.151, 6.12.103, 6.18.44, and 7.1.8.

Technical ContextAI

The affected code resides in the s390 (IBM mainframe) zcrypt subsystem of the Linux kernel, which provides the kernel-side interface to IBM Z cryptographic hardware coprocessors using the CCA (Common Cryptographic Architecture) protocol. The function cca_cipher2protkey() constructs a CPRB (Control Program Request Block) - a fixed-size structure passed to the hardware - and uses the length field embedded within the supplied CCA AES cipher key token to determine how many bytes to copy into the CPRB parameter block area. Because this length is sourced from user-controlled input without prior bounds checking against the actual allocated buffer size, a crafted token can cause the copy to exceed the buffer boundary, corrupting adjacent kernel memory. CWE is unassigned in NVD, but the root cause class is clearly insufficient input validation before a length-controlled memory operation (analogous to CWE-119/CWE-129). CPE data (cpe:2.3:a:linux:linux) confirms this is a mainline Linux kernel issue, introduced at commit 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd.

RemediationAI

The primary remediation is upgrading the Linux kernel to a patched stable release: 6.6.151, 6.12.103, or 6.18.44 for the respective 6.x LTS branches, 7.1.8 for the 7.1 branch, or any build from 7.2-rc6 onward. Patch commits are published on the kernel.org stable tree (see references). For systems that cannot be immediately patched, restrict access to the zcrypt device node (commonly /dev/z90crypt or equivalent under /dev/) to only trusted users and service accounts using filesystem permissions (chmod/chown) or mandatory access control policies (SELinux or AppArmor). This compensating control limits the set of principals able to supply malicious key token data; the trade-off is that it blocks hardware cryptographic acceleration for restricted users, which may affect workload performance. A more disruptive mitigation is to unload the zcrypt kernel module entirely (rmmod zcrypt), which eliminates the attack surface but disables all CCA and EP11 hardware crypto operations on the system. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-68452.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68452 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy