Linux Kernel CVE-2026-80545

Exploitation requires all of the following: the target system must be running Linux on s390/IBM Z architecture; EP11 cryptographic coprocessor hardware must be present and the zcrypt kernel module loaded; the attacker must have local user access to the system with read/write permissions to the zcrypt device node (not granted to all users by default). Exploitation is limited to local attack vector (AV:L) - no network-based exploitation path exists. The CVSS PR:L confirms that low-privileged (non-root) authenticated local access is sufficient; no administrator credentials are needed once device node access is available. Systems not running s390 architecture, or those without EP11 hardware, are not affected regardless of kernel version.

The official CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) appropriately captures the local privilege escalation risk. Attack complexity is genuinely low once the attacker has a shell on an affected system - no race condition or brute-force is required, just a crafted ioctl call. However, real-world risk is strongly bounded by two factors: first, the vulnerability is architecture-specific, affecting only s390/IBM Z Linux systems with EP11 coprocessor hardware, which narrows exposure to a specialized enterprise segment (banks, telcos, government); second, the attacker must already hold local user access with permissions to the zcrypt device node, which is not typically granted to all users. No EPSS data was provided in the input. KEV status is absent, meaning CISA has not confirmed active exploitation. No POC has been reported. The net assessment is a genuine high-severity local privilege escalation for the specific affected population, but not a broad-impact internet-facing threat. EPSS and KEV absence does not reduce severity for operators of s390 infrastructure - the attack complexity is low enough that exploitation upon local access is feasible.

A local unprivileged user on an IBM Z/s390 Linux system crafts a malformed EP11 CPRB with a length field engineered to trigger the CEIL4 integer overflow, causing the computed aligned size to wrap below the actual payload size. When submitted via ioctl to the zcrypt driver, this causes the kernel to copy more data than the allocated buffer can hold, resulting in a kernel buffer overflow. No public exploit code has been identified at time of analysis, but the attack is mechanically straightforward for a researcher with kernel exploit experience given that AC:L is confirmed in the CVSS vector.