CVE-2026-68451: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68451 is a buffer access vulnerability (CWE-805) in the Linux kernel's s390/zcrypt subsystem, specifically in the cca_ecc2protkey() function handling CCA ECC private key requests. The function derives the copy length for the CPRB parameter block directly from the length field in the key token without validating that it fits within the available space, enabling a buffer overflow condition. It affects Linux kernel versions from 5.10 up to (but not including) the fixed releases: 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. Disclosed on August 13, 2026, it carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-805 (Buffer Access with Incorrect Length Value). In cca_ecc2protkey(), the copy length used for the CPRB parameter block is derived directly from the length field embedded in the caller-supplied key token, with no check that this value is within the bounds of the allocated parameter block buffer. A local attacker with access to the zcrypt device interface can craft a key token with an oversized length field, causing the kernel to write beyond the buffer boundary. The fix adds an early rejection of requests where the token length exceeds the available space in the parameter block (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in a kernel crash (denial of service) or, in more severe scenarios, memory corruption that could potentially lead to privilege escalation or information disclosure — reflected in the CVSS High scores for confidentiality, integrity, and availability impacts. The vulnerability is limited to s390 (IBM Z) architecture systems with the zcrypt module loaded and accessible, restricting the affected asset scope to IBM Z mainframe environments. Lateral movement potential is limited given the local attack vector, but a kernel crash on a mainframe could have significant availability consequences for enterprise workloads (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). Exploitation requires local access with low privileges to the zcrypt device interface, which significantly limits the attacker pool to users or processes with access to the s390 cryptographic hardware interface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Feedly).

Update the Linux kernel to a patched version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 and later. The corresponding upstream fix commits are dd25bd9b0f36, ecc3b8691c19, 013a4484f061, 8fa3e9435a13, and a9ae0f6dd45c. As a workaround where patching is not immediately possible, restrict access to the zcrypt device interface (/dev/z90crypt or equivalent) to only trusted users and processes using appropriate file permissions or access control policies (GitHub Advisory, Red Hat Bugzilla).