Linux Kernel EUVD-2026-66461

Exploitation requires: (1) the target system must run Linux on IBM Z (s390x) hardware - all other architectures are entirely unaffected; (2) the zcrypt kernel driver must be loaded (typical on IBM Z Linux distributions with hardware crypto accelerators); (3) the /dev/z90crypt character device must be accessible to the attacker's account, which is the default for users in the zcrypt group or where device permissions are open. The attacker submits a crafted CPRBX structure via the ZSECSENDCPRB or ZSENDCPRB ioctl, triggering overflow in xcrb_msg_to_type6cprb_msgx(). No special software installation, no network access, and no admin interaction are required once local shell access is established. Exploitation is limited to: authenticated local shell access (PR:L per CVSS), s390x architecture only, and kernel versions prior to 7.1.10 or 7.2.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the realistic threat model: a local user with shell access and read/write permission on /dev/z90crypt can exploit this with low complexity and without any privileged account. The full C:H/I:H/A:H impact reflects the potential for kernel memory corruption leading to privilege escalation or system crash. The principal mitigating factor is architecture specificity - this subsystem runs exclusively on IBM Z (s390x) hardware, a platform confined to enterprise mainframe environments, which sharply limits the total population of exposed systems compared to a vulnerability in a universally deployed kernel subsystem like netfilter or ext4. EPSS data was not included in the source intelligence, making probabilistic exploitation likelihood estimation unavailable. No KEV listing and no public POC have been identified, consistent with a kernel hardening fix that has not yet been weaponized. Organizations running Linux on IBM Z should treat this as a priority local privilege escalation for their platform, while x86 and ARM deployments are entirely unaffected.

A local user with a standard unprivileged account on an IBM Z Linux system crafts a malformed CPRBX ioctl message with field lengths designed to trigger signed integer wraparound during alignment, causing the kernel to allocate a buffer smaller than the data to be written. The attacker then submits the oversized payload, overflowing into adjacent kernel memory structures and enabling overwrite of function pointers or security-critical kernel data to escalate privileges to root. No public POC has been identified, but the low attack complexity (AC:L) suggests this is straightforward to develop given knowledge of the zcrypt ioctl ABI.