EUVD-2026-67444
GHSA-w33j-vhfx-hgqc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L (local device node access required), PR:L (low privilege needed); I:L not I:H because description confirms heap read, not confirmed arbitrary write.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device nodes but may lead to access heap memory behind perms->adm when an administrative CPRB is sent. Add correct limit (AP_DOMAINS = 256) checking to fix this.
AnalysisAI
Heap out-of-bounds memory access in the Linux kernel s390/zcrypt subsystem exposes EP11 crypto card administrative paths to local low-privileged users. The flaw resides in the domain value upper-limit check processed when sending EP11 CPRBs (Control Program Request Blocks) through custom zcrypt device nodes - the missing AP_DOMAINS (256) ceiling allows an attacker-supplied domain index to reach heap memory beyond the perms->adm structure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: the host system must run on s390/IBM Z architecture (AV:L confirmed); a custom zcrypt device node must exist and be accessible to the attacker - standard /dev/z90crypt nodes are not affected; the attacker must hold at least low-privilege local access to submit an EP11 administrative CPRB (PR:L from CVSS vector); and an EP11-capable CEX crypto adapter must be present. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local, low-complexity exploit with full CIA impact - consistent with heap corruption primitives that can expose cryptographic key material (C:H) and destabilize kernel memory (I:H, A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched Linux kernel stable release: 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Linux systems running on s390 architecture with zcrypt cryptographic hardware attached, prioritizing production systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today