s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
CVE-2026-68453 · published 13 Aug 2026
How serious is it
- Severity: high, CVSS score 7.1 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-68453?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to < d0951ed366710a1a303b7cb2f8eb3d866cd68fc6, 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to < 353e442d18084b24fb3ede4e5adfca26b25f0e89, 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to < a57fd7fcdb63e2d5ceac78bbe825ec986062a9da, 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd to < 3b2abee2a678607ae27975bc6833785c2002df43
- Linux Linux: 5.4
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
Add validation of both the actual key buffer size and token length
fields in all the cca_check_sec*token() functions. Additionally check
in cca_gencipherkey() for possible underflow with returned key size.
The CCA token structures contain user-controlled len fields that
were used in operations without proper validation against both the
actual buffer size and minimum token structure size. An attacker
could set this field larger than the actual buffer size, leading to
reading beyond buffer boundaries. This may result in a kernel crash or
exposure of memory via sending this as part of a request down to the
crypto card. Also an attacker could have used a very small len value
and thus enforce a buffer under-run which may produce similar effects
as a over-read.
So now a key must
- key buf length must be at least sizeof the token struct
- the key len field inside the token must fit into the range of
sizeof key token struct ... key buf length
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/d0951ed366710a1a303b7cb2f8eb3d866cd68fc6
- git.kernel.org/stable/c/353e442d18084b24fb3ede4e5adfca26b25f0e89
- git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da
- git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43
- git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON