EUVD-2026-50405
GHSA-82p5-pf6r-jcxr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local pkey ioctl access needed (AV:L, PR:L), no user interaction, and an out-of-bounds kernel write yields high C/I/A within an unchanged scope.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Check length in pkey_pckmo handler implementation
Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer.
Articles & Coverage 1
AnalysisAI
Local privilege-impacting memory corruption in the Linux kernel's s390 (IBM Z) pkey subsystem allows a low-privileged local user to trigger an out-of-bounds write through the pkey_pckmo key_to_protkey() handler, which failed to validate that generated protected-key output fits within the caller-provided target buffer. The flaw affects s390 builds of the kernel prior to the fixed stable releases and carries high confidentiality, integrity, and availability impact (CVSS 7.8). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a Linux system running on the s390/IBM Z architecture with the pkey (protected key) subsystem present and the ability to invoke the PCKMO key_to_protkey() conversion path - in practice, permission to issue ioctls against the pkey device (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent with a local, low-complexity, low-privilege kernel memory-corruption bug requiring no user interaction, and I concur with those metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with permission to open the s390 pkey device on an IBM Z Linux host invokes the protected-key conversion ioctl with a target buffer smaller than the output the PCKMO operation produces. On an unpatched kernel the handler writes past the end of that buffer, corrupting kernel memory, which a skilled attacker could shape toward privilege escalation or use to crash the system. … |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - 6.12.97 (6.12.x), 6.18.40 (6.18.x), 7.1.5 (7.1.x), or mainline 7.2-rc1 or later - which add the explicit target-buffer length check in the pkey_pckmo key_to_protkey() handler; the corresponding upstream fix commits are at https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc, .../433e5e70cdc1edf382d28d08a885b22e2b98b7da, .../614aa0491c7a190556c2345dddee0b6f5ed90989, and .../1ac287e2af9a9112fe271427ef45eceb26bce8b4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an asset inventory to identify all IBM Z systems running Linux kernel versions prior to the vendor-released fix and assess current exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today