-

CVE-2026-97592

s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

In the Linux kernel, the following vulnerability has been resolved:

s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

In function ctr_aes_crypt() there is a buffer used to process
remaining bytes < AES_BLOCK_SIZE. This buffer was not scrubbed and
thus could lead to expose of unwanted data. When the buffer is used
explicitly scrub it at the end of the code block to avoid exposure of
maybe sensitive data.

In a similar way the function gcm_aes_crypt() hat an error path where
the CPACF param block was not scrubbed. Instead of return early now
these error paths go to end of function where explicit scrubbing is
done. Similar with the buffers which are part of the gcm_sg_walk
structs from the variables gw_in and gw_out.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version cd51e26a3b89706beec64f2d8296cfb1c34e0c79
Version < 538f00558db9a66aeff20c36f43692c178a0e0eb
Status affected
Version a7f580cdb42ec3d53bbb7c4e4335a98423703285
Version < 6ab772d675a885c3119bf0e79ea9e84756d7657a
Status affected
Version dbc9a791a70ea47be9f2acf251700fe254a2ab23
Version < e17b85eb8cee90a1200fa5e7806db7ffa08a0608
Status affected
Version d68ac38895e84446848b7647ab9458d54cacba3e
Version < 991c875310254a13b3a637bb279379c8c66e842d
Status affected
Version d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version < 11eca05d2062032e1f07d56be58ed0b99f4b1d63
Status affected
Version d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version < 8b90a47c4fba27bb4f2f086611742493629e9696
Status affected
Version d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version < a83488cecb35f924b7541306ed84893bb9906196
Status affected
Version d07f951903fa9922c375b8ab1ce81b18a0034e3b
Version < 8b7c3b6914f19caf648d05726a86af6326d3c2c6
Status affected
Version e78f1a43e72daf77705ad5b9946de66fc708b874
Status affected
Version 5.10.210
Version < 5.10.271
Status affected
Version 5.15.149
Version < 5.15.222
Status affected
Version 6.1.76
Version < 6.1.189
Status affected
Version 6.6.15
Version < 6.6.158
Status affected
Version 6.7.3
Version < 6.8
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.8
Status affected
Version 0
Version < 6.8
Status unaffected
Version <= 5.10.*
Version 5.10.271
Status unaffected
Version <= 5.15.*
Version 5.15.222
Status unaffected
Version <= 6.1.*
Version 6.1.189
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.088
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/11eca05d2062032e1f07d56be58ed0b99f4b1d63
https://git.kernel.org/stable/c/8b90a47c4fba27bb4f2f086611742493629e9696
https://git.kernel.org/stable/c/a83488cecb35f924b7541306ed84893bb9906196
https://git.kernel.org/stable/c/8b7c3b6914f19caf648d05726a86af6326d3c2c6
https://git.kernel.org/stable/c/538f00558db9a66aeff20c36f43692c178a0e0eb
https://git.kernel.org/stable/c/6ab772d675a885c3119bf0e79ea9e84756d7657a
https://git.kernel.org/stable/c/991c875310254a13b3a637bb279379c8c66e842d
https://git.kernel.org/stable/c/e17b85eb8cee90a1200fa5e7806db7ffa08a0608