Linux Kernel EUVD-2026-57922

The affected code resides in the Linux kernel's s390 architecture cryptographic subsystem (drivers/s390/crypto/), which provides the software interface to IBM Z hardware cryptographic accelerator cards (CEX cards) using the CCA (Common Cryptographic Architecture) protocol. CCA key token structures passed through this interface contain user-controlled 'len' fields that represent the declared size of the token payload. Prior to the fix, functions including cca_check_sec*token() and cca_gencipherkey() consumed these len fields in memory operations without validating them against two critical bounds: the actual allocated buffer size and the minimum valid size of the token structure. An oversized len value causes an out-of-bounds read beyond the buffer (CWE-125), while an artificially small len can produce a buffer under-run producing similar effects. The fix enforces that key buffer length must be at least sizeof(token struct) and the internal len field must fall within the range [sizeof(token struct), key buf length]. The CPE identifier is cpe:2.3:a:linux:linux and the vulnerability is strictly architecture-scoped to s390/IBM Z.