CVE-2026-80544

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing<br /> <br /> The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct<br /> overlays to access and modify the domain field in the EP11 CPRB<br /> payload, creating maintainability and security concerns:<br /> 1. Struct overlay approach (pld_hdr) assumes fixed payload structure<br /> and doesn&amp;#39;t validate the actual ASN.1 encoding.<br /> 2. Complex length format detection logic is error-prone and doesn&amp;#39;t<br /> properly validate bounds at each parsing step.<br /> 3. Direct struct member access bypasses proper ASN.1 validation.<br /> <br /> Fix by replacing struct overlays with explicit ASN.1 parsing that<br /> validates each field (payload tag/length, function tag/length/value,<br /> optional domain tag/length/value) with proper bounds checking at every<br /> step. Add asn1_int_encode() helper function to safely write integer<br /> values with correct endianness conversion. This makes the code<br /> consistent with the validation pattern introduced with the rework of<br /> the xcrb_msg_to_type6_ep11cprb_msgx() function.