CVE-2026-97592 (GCVE-0-2026-97592)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-19 09:09
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm In function ctr_aes_crypt() there is a buffer used to process remaining bytes < AES_BLOCK_SIZE. This buffer was not scrubbed and thus could lead to expose of unwanted data. When the buffer is used explicitly scrub it at the end of the code block to avoid exposure of maybe sensitive data. In a similar way the function gcm_aes_crypt() hat an error path where the CPACF param block was not scrubbed. Instead of return early now these error paths go to end of function where explicit scrubbing is done. Similar with the buffers which are part of the gcm_sg_walk structs from the variables gw_in and gw_out.
References
Impacted products
Vendor Product Version
Linux Linux Version: cd51e26a3b89706beec64f2d8296cfb1c34e0c79
Version: a7f580cdb42ec3d53bbb7c4e4335a98423703285
Version: dbc9a791a70ea47be9f2acf251700fe254a2ab23
Version: d68ac38895e84446848b7647ab9458d54cacba3e
Version: d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version: d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version: d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version: d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version: e78f1a43e72daf77705ad5b9946de66fc708b874
Version: 5.10.210   ≤
Version: 5.15.149   ≤
Version: 6.1.76   ≤
Version: 6.6.15   ≤
Version: 6.7.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/crypto/aes_s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "538f00558db9a66aeff20c36f43692c178a0e0eb",
              "status": "affected",
              "version": "cd51e26a3b89706beec64f2d8296cfb1c34e0c79",
              "versionType": "git"
            },
            {
              "lessThan": "6ab772d675a885c3119bf0e79ea9e84756d7657a",
              "status": "affected",
              "version": "a7f580cdb42ec3d53bbb7c4e4335a98423703285",
              "versionType": "git"
            },
            {
              "lessThan": "e17b85eb8cee90a1200fa5e7806db7ffa08a0608",
              "status": "affected",
              "version": "dbc9a791a70ea47be9f2acf251700fe254a2ab23",
              "versionType": "git"
            },
            {
              "lessThan": "991c875310254a13b3a637bb279379c8c66e842d",
              "status": "affected",
              "version": "d68ac38895e84446848b7647ab9458d54cacba3e",
              "versionType": "git"
            },
            {
              "lessThan": "11eca05d2062032e1f07d56be58ed0b99f4b1d63",
              "status": "affected",
              "version": "d07f951903fa9922c375b8ab1ce81b18a0034e3b",
              "versionType": "git"
            },
            {
              "lessThan": "8b90a47c4fba27bb4f2f086611742493629e9696",
              "status": "affected",
              "version": "d07f951903fa9922c375b8ab1ce81b18a0034e3b",
              "versionType": "git"
            },
            {
              "lessThan": "a83488cecb35f924b7541306ed84893bb9906196",
              "status": "affected",
              "version": "d07f951903fa9922c375b8ab1ce81b18a0034e3b",
              "versionType": "git"
            },
            {
              "lessThan": "8b7c3b6914f19caf648d05726a86af6326d3c2c6",
              "status": "affected",
              "version": "d07f951903fa9922c375b8ab1ce81b18a0034e3b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e78f1a43e72daf77705ad5b9946de66fc708b874",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.271",
              "status": "affected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.222",
              "status": "affected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.189",
              "status": "affected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/crypto/aes_s390.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.10.210",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.15.149",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "6.1.76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm\n\nIn function ctr_aes_crypt() there is a buffer used to process\nremaining bytes \u003c AES_BLOCK_SIZE. This buffer was not scrubbed and\nthus could lead to expose of unwanted data. When the buffer is used\nexplicitly scrub it at the end of the code block to avoid exposure of\nmaybe sensitive data.\n\nIn a similar way the function gcm_aes_crypt() hat an error path where\nthe CPACF param block was not scrubbed. Instead of return early now\nthese error paths go to end of function where explicit scrubbing is\ndone. Similar with the buffers which are part of the gcm_sg_walk\nstructs from the variables gw_in and gw_out."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:09:56.137Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/538f00558db9a66aeff20c36f43692c178a0e0eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ab772d675a885c3119bf0e79ea9e84756d7657a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e17b85eb8cee90a1200fa5e7806db7ffa08a0608"
        },
        {
          "url": "https://git.kernel.org/stable/c/991c875310254a13b3a637bb279379c8c66e842d"
        },
        {
          "url": "https://git.kernel.org/stable/c/11eca05d2062032e1f07d56be58ed0b99f4b1d63"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b90a47c4fba27bb4f2f086611742493629e9696"
        },
        {
          "url": "https://git.kernel.org/stable/c/a83488cecb35f924b7541306ed84893bb9906196"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b7c3b6914f19caf648d05726a86af6326d3c2c6"
        }
      ],
      "title": "s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97592",
    "datePublished": "2026-09-25T10:22:09.305Z",
    "dateReserved": "2026-09-24T16:01:01.157Z",
    "dateUpdated": "2026-10-19T09:09:56.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.