s390/zcrypt: Validate length for CCA AES cipher key requests

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 5.4affected
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before be037204e4f595e4bd2159acda146677a1dc6342affected · git
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before 4e500ecb6704d879f9c2417c2ed6faba595015caaffected · git
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before 7f9e5a3dbb14a9b321a1dfa30390402c673f82dcaffected · git
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before 406b317ea2b501f6f5eca1264293c9399a73a778affected · git
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before 4fc46deceda076d429ef3fab2ccf8d96629ebd23affected · git
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before ad93a1f1a45652478c0cf4eb029114e03af57f3baffected · git
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before 3859f630b674801a00bca39bc451f52288591f65affected · git
  • 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and later · before 06afe425d5283b9764303de47f554da5a808ce8aaffected · git
  • before 5.4not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation
  40Plan
• CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment
  40Plan
• CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()
  40Plan

Published before and after this one in the same product

• ← EarlierCVE-2026-68448Aug 12, 2026 · ovl: check access to copy_file_range source with src mounter creds
  0Monitor
• ← EarlierCVE-2026-68451Aug 13, 2026 · s390/zcrypt: Validate length for CCA ECC private key requests
  31Monitor
• Later →CVE-2026-68453Aug 13, 2026 · s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
  28Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.