{"api_version":"1","generated_at":"2026-08-13T19:48:38+00:00","cve":"CVE-2026-68453","urls":{"html":"https://cve.report/CVE-2026-68453","api":"https://cve.report/api/cve/CVE-2026-68453.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68453","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68453"},"summary":{"title":"s390/zcrypt: Fix buffer over-read in cca_cipher2protkey","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix buffer over-read in cca_cipher2protkey\n\nAdd validation of both the actual key buffer size and token length\nfields in all the cca_check_sec*token() functions. Additionally check\nin cca_gencipherkey() for possible underflow with returned key size.\n\nThe CCA token structures contain user-controlled len fields that\nwere used in operations without proper validation against both the\nactual buffer size and minimum token structure size. An attacker\ncould set this field larger than the actual buffer size, leading to\nreading beyond buffer boundaries. This may result in a kernel crash or\nexposure of memory via sending this as part of a request down to the\ncrypto card. Also an attacker could have used a very small len value\nand thus enforce a buffer under-run which may produce similar effects\nas a over-read.\n\nSo now a key must\n- key buf length must be at least sizeof the token struct\n- the key len field inside the token must fit into the range of\n  sizeof key token struct ... key buf length","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-13 15:19:58","updated_at":"2026-08-13 15:19:58"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43","name":"https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d","name":"https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da","name":"https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68453","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68453","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd a57fd7fcdb63e2d5ceac78bbe825ec986062a9da git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd 3b2abee2a678607ae27975bc6833785c2002df43 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd 36b230835b8a008266aad22168ca52afacc8a58d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.44 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.8 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc6 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_cca.c","drivers/s390/crypto/zcrypt_ccamisc.c","drivers/s390/crypto/zcrypt_ccamisc.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a57fd7fcdb63e2d5ceac78bbe825ec986062a9da","status":"affected","version":"4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd","versionType":"git"},{"lessThan":"3b2abee2a678607ae27975bc6833785c2002df43","status":"affected","version":"4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd","versionType":"git"},{"lessThan":"36b230835b8a008266aad22168ca52afacc8a58d","status":"affected","version":"4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_cca.c","drivers/s390/crypto/zcrypt_ccamisc.c","drivers/s390/crypto/zcrypt_ccamisc.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.44","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc6","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.44","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.8","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc6","versionStartIncluding":"5.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix buffer over-read in cca_cipher2protkey\n\nAdd validation of both the actual key buffer size and token length\nfields in all the cca_check_sec*token() functions. Additionally check\nin cca_gencipherkey() for possible underflow with returned key size.\n\nThe CCA token structures contain user-controlled len fields that\nwere used in operations without proper validation against both the\nactual buffer size and minimum token structure size. An attacker\ncould set this field larger than the actual buffer size, leading to\nreading beyond buffer boundaries. This may result in a kernel crash or\nexposure of memory via sending this as part of a request down to the\ncrypto card. Also an attacker could have used a very small len value\nand thus enforce a buffer under-run which may produce similar effects\nas a over-read.\n\nSo now a key must\n- key buf length must be at least sizeof the token struct\n- the key len field inside the token must fit into the range of\n  sizeof key token struct ... key buf length"}],"providerMetadata":{"dateUpdated":"2026-08-13T13:59:56.036Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da"},{"url":"https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43"},{"url":"https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d"}],"title":"s390/zcrypt: Fix buffer over-read in cca_cipher2protkey","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68453","datePublished":"2026-08-13T13:59:56.036Z","dateReserved":"2026-07-30T09:28:09.395Z","dateUpdated":"2026-08-13T13:59:56.036Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-13 15:19:58","lastModifiedDate":"2026-08-13 15:19:58","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68453","Ordinal":"1","Title":"s390/zcrypt: Fix buffer over-read in cca_cipher2protkey","CVE":"CVE-2026-68453","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68453","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix buffer over-read in cca_cipher2protkey\n\nAdd validation of both the actual key buffer size and token length\nfields in all the cca_check_sec*token() functions. Additionally check\nin cca_gencipherkey() for possible underflow with returned key size.\n\nThe CCA token structures contain user-controlled len fields that\nwere used in operations without proper validation against both the\nactual buffer size and minimum token structure size. An attacker\ncould set this field larger than the actual buffer size, leading to\nreading beyond buffer boundaries. This may result in a kernel crash or\nexposure of memory via sending this as part of a request down to the\ncrypto card. Also an attacker could have used a very small len value\nand thus enforce a buffer under-run which may produce similar effects\nas a over-read.\n\nSo now a key must\n- key buf length must be at least sizeof the token struct\n- the key len field inside the token must fit into the range of\n  sizeof key token struct ... key buf length","Type":"Description","Title":"s390/zcrypt: Fix buffer over-read in cca_cipher2protkey"}]}}}