CVE-2026-80709

What it actually does

Incorrect upper limit verification on domain value during EP11 CPRB handling in s390/zcrypt allows out-of-bounds access to heap memory adjacent to perms->adm when an administrative CPRB is processed on custom device nodes.

Why it matters to the business

Local attackers on affected s390 Linux systems could read or corrupt kernel memory, enabling privilege escalation or data exposure; low observed exploitation risk reduces immediate urgency but still requires patching of widely deployed kernels.

How an attack unfolds

An attacker with local access on an s390 system opens a custom zcrypt device node and submits a crafted administrative EP11 CPRB containing a domain value exceeding the intended bound; the missing AP_DOMAINS=256 check permits the kernel to dereference and access heap memory past the perms structure.

How to fix it

Apply the upstream kernel commit that adds the correct AP_DOMAINS=256 domain limit check for EP11 CPRBs; rebuild and deploy the patched kernel across all affected s390 systems.

How to confirm the fix worked

Confirm the corrected domain check (AP_DOMAINS limit) exists in the zcrypt EP11 CPRB processing code; attempt to submit a CPRB with domain value 256 or higher on a custom node and verify the request is rejected before the faulty pointer access occurs.

Typical attack path

1. Gain local shell or process execution on target s390 Linux host
2. Open a custom /dev/zcrypt or similar EP11 device node
3. Construct and submit administrative CPRB with domain >= 256
4. Trigger kernel path that performs out-of-bounds memory access via perms->adm

How to detect it

Inspect kernel logs and audit trails for zcrypt or EP11 CPRB processing errors mentioning domain values; look for processes opening custom crypto device nodes followed by large or invalid domain parameters; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on all s390 systems that expose custom zcrypt nodes
• Restrict permissions on custom crypto device nodes to least-privilege users only
• Audit local processes that interact with EP11 CPRBs for unexpected domain values
• Include the patched kernel in standard image builds and CI pipelines