Linux Kernel CVE-2026-68453

Exploitation requires: (1) local access to an IBM Z (s390 architecture) Linux system - this vulnerability does not exist on x86, ARM, or any non-s390 Linux deployment; (2) at least low-privilege user-level access to the system (PR:L per CVSS); and (3) ability to interact with the zcrypt/z90crypt device interface, which may be restricted to specific groups or service accounts by default depending on distribution configuration. There is no remote attack vector - the CVSS AV:L confirms local-only exploitation. The attack requires no user interaction and no special configuration beyond a system with CCA-capable IBM CEX cryptographic hardware present and the zcrypt driver loaded. Exploitation is limited by: architecture specificity (IBM Z only), requirement for local system access, and potential device-node permission controls applied by the OS or distribution.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H scoring 7.1 is well-calibrated: exploitation requires physical or logical local access to an s390 system with the ability to interact with the zcrypt device interface, which is a meaningful barrier. The High confidentiality impact is justified by potential exposure of adjacent kernel memory, and the High availability impact reflects the kernel crash potential - both realistic outcomes of an out-of-bounds kernel read. EPSS data was not provided in the available intelligence, and there is no CISA KEV listing and no known POC, substantially reducing immediate exploitation urgency. The critical limiting factor is architecture specificity: this vulnerability is exclusive to IBM Z/s390 hardware with CCA-capable crypto cards, meaning the vast majority of Linux deployments on x86, ARM, and other architectures are entirely unaffected. For IBM Z operators running multi-tenant or untrusted-user workloads, this is a genuine priority due to kernel crash and memory disclosure potential. For all other Linux deployments, this CVE is not applicable.

A low-privileged local user on an IBM Z mainframe running a vulnerable Linux kernel crafts a CCA key token buffer with an oversized len field value that exceeds the actual buffer allocation, then submits it to the zcrypt driver via the crypto card device interface. The kernel reads beyond the allocated buffer boundary in cca_check_sec*token(), either crashing the kernel with a BUG or oops, or returning memory contents from adjacent kernel allocations as part of the crypto card request - potentially disclosing sensitive data from other processes or kernel structures. No public exploit code has been identified at time of analysis.