CVE-2026-80709

The s390 zcrypt crypto driver in the Linux kernel performs an incorrect upper-limit check on the cryptographic domain value when processing EP11 crypto control blocks (CPRBs) destined for a crypto card. This flawed check is only active on custom device nodes and can cause the driver to access heap memory beyond the perms->adm structure when an administrative CPRB is sent, which the CVSS rating (local attack vector, low privileges, high confidentiality/integrity/availability impact) suggests could yield information disclosure, corruption, or a crash. Only Linux on IBM Z (s390) systems using the zcrypt driver with EP11 configured through custom device nodes is affected. A local attacker with limited privileges could potentially exploit the bad bounds check by sending a crafted administrative CPRB. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates only a 0.1% probability of exploitation within 30 days.

What to do: Apply the kernel update from your distribution that includes the s390/zcrypt fix adding the correct AP_DOMAINS (256) domain limit check for EP11 CPRBs. As an interim mitigation, avoid or restrict the use of custom zcrypt device nodes for EP11 and limit local unprivileged access to crypto adapter device nodes on affected IBM Z systems. Verify whether your environment sends administrative CPRBs through custom device nodes, as that is the trigger condition.