CVE-2026-80545

A flaw was found in the Linux kernel's s390/zcrypt component. This vulnerability stems from insufficient input validation in the xcrbmsgtotype6ep11cprbmsgx function when handling EP11 Cryptographic Coprocessor Request Block CPRB messages. A local attacker could exploit this by crafting a maliciou...

CVE-2026-80546

A flaw was found in the Linux kernel's s390/zcrypt component, specifically within the xcrbmsgtotype6cprbmsgx function. This vulnerability is due to insufficient input validation, which can lead to integer overflows during memory allocation and arithmetic operations, as well as a lack of minimum...

EUVD-2026-66499

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound, then set udataoffset to a fixed...

EUVD-2026-66466

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full...

EUVD-2026-66470

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

EUVD-2026-66468

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn't...

EUVD-2026-66467

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

EUVD-2026-66465

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

EUVD-2026-66469

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...

EUVD-2026-66463

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Selectively expand iomutex The iomutex was defined to serialize the ioregions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of race...

EUVD-2026-66461

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

EUVD-2026-66459

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcryptmsgtype6sendep11cprb function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and...

EUVD-2026-66460

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrbmsgtotype6ep11cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11cprb structure and...

EUVD-2026-66462

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80554

A flaw was found in the Linux kernel's s390/vfioccw component. The vfio-ccw logic processes channel programs recursively, breaking them into segments when a Transfer-In-Channel TIC Channel Command Word CCW is encountered. An attacker could exploit the lack of a proper limit on these segments,...

CVE-2026-80584

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatalen without checking a lower bound, then set udataoffset to a fixed...

CVE-2026-80555

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

CVE-2026-80550

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

CVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80549

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Move cp cleanup out of not operational The fsmnotoper routine is called when the device has been lost, and is by definition no longer operational. Since this can happen asynchronously from the normal behavior of the...