CVE-2026-80708

A moderate information disclosure flaw was found in the Linux kernel's s390/zcrypt module. During the clear key to secure key token import process, the internal buffer used by the _ip_cprb_helper() function was not scrubbed after use, which could leave clear cryptographic key material in kernel memory. A local attacker able to trigger the clear key import path and subsequently reuse the affected memory could expose this key material, resulting in disclosure of sensitive cryptographic key material. The kernel and kernel-rt components in Red Hat Enterprise Linux 9 and 10 and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2 are affected; the fix for these streams is deferred to a future update, so the residual risk is that clear key material may remain in unscrubbed kernel memory on s390 systems that use clear key imports until the fix is applied. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams.