CVE-2026-64559 (GCVE-0-2026-64559)
Vulnerability from cvelistv5
Published
2026-07-29 16:31
Modified
2026-08-17 04:57
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8fcc231ce3bea12b78bb94b280cdc03cff342435
Version: 8fcc231ce3bea12b78bb94b280cdc03cff342435
Version: 8fcc231ce3bea12b78bb94b280cdc03cff342435
Version: 8fcc231ce3bea12b78bb94b280cdc03cff342435
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/pkey_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a9e34ccbe772b8f321388cdbdf4f22b94e513e7",
              "status": "affected",
              "version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
              "versionType": "git"
            },
            {
              "lessThan": "693bf91d4db134f9b1c2840c8e287eee3d993bac",
              "status": "affected",
              "version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
              "versionType": "git"
            },
            {
              "lessThan": "7e7e03848c918aa0acad5ffd75d929e3afec1554",
              "status": "affected",
              "version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
              "versionType": "git"
            },
            {
              "lessThan": "b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970",
              "status": "affected",
              "version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/pkey_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in PKEY_VERIFYPROTK ioctl\n\nExplicitly check the buffer length request structure provided by\nuser-space and fail, if it exceeds the buffer size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the PKEY_VERIFYPROTK ioctl on the /dev/pkey character device, which requires local access to the system. There is no network-facing path to this code.\nAC:L - Triggering is fully deterministic \u2014 a single ioctl with protkey.len set to 0x20000010 wraps the u32 multiplication to a legal 128-bit keytype and drives the unchecked memcpy; no race, timing, or uncontrollable memory-layout condition is involved.\nPR:L - The pkey miscdevice is registered with .mode = 0666 and neither the open handler nor pkey_unlocked_ioctl performs any capability check, so any unprivileged local user (including a normal shell user on a shared IBM Z LPAR or z/VM guest) can issue the ioctl.\nUI:N - The attacker performs the entire attack via its own ioctl call; no action by any other user or administrator is needed.\nS:U - The out-of-bounds read and write are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked memcpy performs a huge out-of-bounds read that walks off the 64-byte on-stack protkey buffer through the entire kernel stack, relocating arbitrary kernel stack contents \u2014 including protected key material handled by this crypto driver \u2014 into heap objects, an unbounded kernel memory disclosure primitive.\nI:H - This is a massive slab out-of-bounds write into an 80-byte kmalloc-96 allocation whose first 64 bytes are entirely attacker-supplied and whose subsequent bytes come from groomable kernel-stack data, corrupting adjacent slab objects and providing a heap-overflow primitive suitable for control-flow hijacking.\nA:H - The smallest length that bypasses the keytype check requests a 512 MB copy, so the source pointer inevitably hits the VMAP_STACK guard page, producing an unhandled kernel fault/oops and panic after wide-scale heap corruption \u2014 a guaranteed, repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:37.809Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a9e34ccbe772b8f321388cdbdf4f22b94e513e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/693bf91d4db134f9b1c2840c8e287eee3d993bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970"
        }
      ],
      "title": "s390/pkey: Check length in PKEY_VERIFYPROTK ioctl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64559",
    "datePublished": "2026-07-29T16:31:22.195Z",
    "dateReserved": "2026-07-19T15:36:31.796Z",
    "dateUpdated": "2026-08-17T04:57:37.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.