CVE-2026-31746: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31746 is a memory leak vulnerability in the Linux kernel's s390/zcrypt subsystem, specifically affecting systems where CCA (Common Cryptographic Architecture) cards are used as accelerators for clear key RSA requests via ME (Message Extension) and CRT (Chinese Remainder Theorem) operations. The flaw was disclosed on May 1, 2026, and affects Linux kernel versions from 6.16 up to (but not including) 6.18.22, 6.19.0 up to (but not including) 6.19.12, and 7.0 release candidates (rc1–rc6). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Bugzilla, Feedly).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). During a prior rework of memory allocation in the zcrypt subsystem, AP messages were refactored to be allocated via ap_init_apmsg(); however, legacy allocation code was inadvertently left in place at two code paths — the ME and CRT RSA operation handlers. As a result, each invocation of these paths performs a duplicate allocation, and the first (older) allocation is never freed, causing a kernel memory leak. Exploitation requires local access with low privileges, as an attacker or process must be able to trigger RSA acceleration operations through the affected subsystem (Red Hat Bugzilla, Feedly).

Repeated RSA acceleration operations using CCA cards will progressively exhaust kernel memory as allocated AP message buffers accumulate without being released. This degradation in available memory can lead to reduced system performance and, under sustained load, system instability or a denial of service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability, primarily affecting IBM s390/z-series systems that rely on CCA hardware for cryptographic acceleration (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation is limited to local, low-privileged users on s390 systems with CCA card acceleration enabled (Feedly).

Upgrade to a patched Linux kernel version: 6.18.22, 6.19.12, or 7.0 (stable), which include fixes via commits 586222c37d40, ace37bfec382, and c8d46f17c2fc. For systems that cannot be immediately patched, administrators should monitor kernel memory utilization on s390 hosts using CCA card RSA acceleration, and consider periodically restarting services performing intensive RSA operations to reclaim leaked memory. Limiting or redistributing RSA acceleration workloads away from CCA cards is an additional interim measure (Red Hat Bugzilla, Feedly).