CVE-2026-80544

A moderate-severity flaw was found in the Linux kernel's s390/zcrypt EP11 support. The zcrypt_msgtype6_send_ep11_cprb() function used fragile struct overlays to access and modify the domain field within the ASN.1-encoded EP11 CPRB payload, assuming a fixed payload structure without validating the actual ASN.1 encoding or properly checking bounds at each parsing step. On systems with the relevant s390 zcrypt EP11 hardware, a local attacker able to submit requests through the zcrypt EP11 interface could craft a malformed CPRB payload that the driver parses based on an assumed layout rather than validated ASN.1 tags and lengths, potentially causing out-of-bounds access and kernel memory corruption; the most plausible consequence is a kernel crash resulting in denial of service. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are affected, and the fix is currently deferred to a future update; the residual risk is limited because exploitation requires local access to the zcrypt EP11 interface on s390 systems and the verified impact is availability only. Red Hat rates this flaw moderate rather than the upstream important rating because exploitation requires local access to the zcrypt EP11 interface and no confidentiality or integrity impact has been established.