CVE-2026-68452: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68452 is a buffer overflow vulnerability in the Linux kernel's s390/zcrypt subsystem, specifically in the cca_cipher2protkey() function handling CCA AES cipher key requests. The function derives the copy length for the CPRB parameter block directly from an untrusted length field in the key token without validating whether it exceeds the available buffer space, enabling a classic buffer overflow condition (CWE-120). The vulnerability affects Linux kernel versions from 5.4 onward, with fixes backported to stable releases 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. It was disclosed on August 13, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input). In cca_cipher2protkey(), the copy length used when populating the CPRB (Control Program Request Block) parameter block is derived directly from the length field embedded in the caller-supplied CCA AES cipher key token, without first verifying that this value does not exceed the allocated buffer size. An attacker with access to the zcrypt device interface can craft a malformed key token with an oversized length field, causing the kernel to copy more data than the destination buffer can hold. The fix adds an early rejection of requests where the token length exceeds the available space in the parameter block (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local user with access to the zcrypt device interface to trigger a kernel-level buffer overflow, potentially leading to privilege escalation, arbitrary code execution in kernel context, or system crashes affecting availability. All three security dimensions — confidentiality, integrity, and availability — are rated High in the CVSS scoring, reflecting the potential for full kernel compromise. The impact is limited to IBM s390/z-series systems running affected Linux kernel versions that expose the zcrypt subsystem (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability requires local access with at least low-level privileges and access to the zcrypt device interface, limiting the attack surface to s390/z-series environments. The EPSS score is reported as 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat Bugzilla).

Patches have been released for all affected stable kernel branches. Administrators should upgrade to Linux kernel versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later). As a workaround where patching is not immediately possible, restrict access to the zcrypt device interface (/dev/z90crypt or equivalent) to trusted users only using appropriate file permissions or access control policies, or disable the zcrypt subsystem entirely if it is not required in the environment (GitHub Advisory, Red Hat Bugzilla).