CVE-2026-80546

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve CCA CPRB length and overflow checks<br /> <br /> The xcrb_msg_to_type6cprb_msgx() function lacks proper input<br /> validation, creating security vulnerabilities:<br /> 1. Integer overflow after CEIL4 alignment: Signed int variables could<br /> overflow during 4-byte boundary alignment, causing undersized<br /> buffer allocations or incorrect bounds checking.<br /> 2. Missing minimum size validation: The CPRBX structure is copied from<br /> userspace without verifying sufficient buffer length. Undersized<br /> buffers cause uninitialized memory access when reading structure<br /> fields like cprbx.cprb_len and cprbx.domain.<br /> 3. Arithmetic overflow in sum calculations: Adding control block and<br /> data block sizes could overflow, bypassing size checks and enabling<br /> buffer overflows.<br /> <br /> Fix by using size_t for length calculations, adding U32_MAX boundary<br /> checks after alignment, validating minimum control block size before<br /> copying from userspace, and detecting sum calculation overflows.