CVE-2026-68453

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Fix buffer over-read in cca_cipher2protkey<br /> <br /> Add validation of both the actual key buffer size and token length<br /> fields in all the cca_check_sec*token() functions. Additionally check<br /> in cca_gencipherkey() for possible underflow with returned key size.<br /> <br /> The CCA token structures contain user-controlled len fields that<br /> were used in operations without proper validation against both the<br /> actual buffer size and minimum token structure size. An attacker<br /> could set this field larger than the actual buffer size, leading to<br /> reading beyond buffer boundaries. This may result in a kernel crash or<br /> exposure of memory via sending this as part of a request down to the<br /> crypto card. Also an attacker could have used a very small len value<br /> and thus enforce a buffer under-run which may produce similar effects<br /> as a over-read.<br /> <br /> So now a key must<br /> - key buf length must be at least sizeof the token struct<br /> - the key len field inside the token must fit into the range of<br /> sizeof key token struct ... key buf length