CVE-2026-68453: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

Add validation of both the actual key buffer size and token length
fields in all the cca_check_sec*token() functions. Additionally check
in cca_gencipherkey() for possible underflow with returned key size.

The CCA token structures contain user-controlled len fields that
were used in operations without proper validation against both the
actual buffer size and minimum token structure size. An attacker
could set this field larger than the actual buffer size, leading to
reading beyond buffer boundaries. This may result in a kernel crash or
exposure of memory via sending this as part of a request down to the
crypto card. Also an attacker could have used a very small len value
and thus enforce a buffer under-run which may produce similar effects
as a over-read.

So now a key must
- key buf length must be at least sizeof the token struct
- the key len field inside the token must fit into the range of
  sizeof key token struct ... key buf length

The Linux kernel CVE team has assigned CVE-2026-68453 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4 with commit 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and fixed in 6.18.44 with commit a57fd7fcdb63e2d5ceac78bbe825ec986062a9da
	Issue introduced in 5.4 with commit 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and fixed in 7.1.8 with commit 3b2abee2a678607ae27975bc6833785c2002df43
	Issue introduced in 5.4 with commit 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd and fixed in 7.2-rc6 with commit 36b230835b8a008266aad22168ca52afacc8a58d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68453
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/s390/crypto/pkey_cca.c
	drivers/s390/crypto/zcrypt_ccamisc.c
	drivers/s390/crypto/zcrypt_ccamisc.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da
	https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43
	https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d