Linux Kernel zcrypt EUVD-2026-66459

Exploitation requires a local user account or process on a Linux system running on IBM Z (s390) mainframe hardware - no remote network vector exists. The EP11 code path is only active when IBM Crypto Express coprocessors are installed and configured in EP11 mode, which is a deliberate non-default enterprise configuration; systems using CCA mode or without Crypto Express hardware are not affected. The attacker must have permission to submit requests to the zcrypt device driver (typically via /dev/z90crypt), which is granted to low-privilege users in some shared mainframe configurations. All x86, ARM, RISC-V, and other non-s390 architectures are completely unaffected regardless of kernel version. The combination of required IBM Z hardware, EP11 mode configuration, and zcrypt device access collectively limits exploitation to a very specific population of production systems.

The CVSS 7.8 HIGH score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is well-calibrated for a local privilege escalation with full CIA impact. The low attack complexity is credible: once a local shell is obtained and the EP11 device node is accessible, crafting a malformed CPRB requires knowledge of the EP11 wire format but no additional runtime conditions. The 'Authentication Bypass' intelligence tag raises the concern that domain field corruption could allow a process to submit EP11 operations destined for a coprocessor domain it has not been authorized to use - a meaningful security boundary violation in multi-tenant HSM environments. No EPSS score was provided, and without KEV confirmation or known public exploit code, empirical exploitation probability cannot be independently assessed; absence of public exploit activity likely reflects the extreme hardware specificity rather than low exploitability in principle. The critical scope-limiting factor is the IBM Z (s390) architecture requirement with EP11 Crypto Express coprocessors configured - this is a non-default enterprise hardware stack entirely absent from commodity x86 and cloud environments. Despite the high CVSS score, real-world risk is bounded to a narrow population of IBM mainframe operators. For those organizations, the low-privilege local vector makes this a genuine priority: any compromised user account or malicious process with zcrypt device access becomes a path to full host compromise.

A low-privilege local user or compromised service account on an IBM Z mainframe running Linux submits a crafted EP11 CPRB request to the zcrypt device driver with a malformed ASN.1 payload - for example, manipulating the domain field's length encoding to trigger an out-of-bounds write during the struct overlay access in zcrypt_msgtype6_send_ep11_cprb(). The memory corruption occurs in kernel context, potentially overwriting adjacent kernel structures to achieve privilege escalation to root or to redirect EP11 operations to an unauthorized coprocessor domain. No public exploit code has been identified, but the low CVSS attack complexity rating and the public availability of the fix commit (which clearly documents the vulnerable parsing logic) provide sufficient detail for an attacker familiar with s390 kernel internals to develop a working exploit.