https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:31:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80544 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing</p> <p>The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and security concerns: 1. Struct overlay approach (pld_hdr) assumes fixed payload structure and doesn&#39;t validate the actual ASN.1 encoding. 2. Complex length format detection logic is error-prone and doesn&#39;t properly validate bounds at each parsing step. 3. Direct struct member access bypasses proper ASN.1 validation.</p> <p>Fix by replacing struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, optional domain tag/length/value) with proper bounds checking at every step. Add asn1_int_encode() helper function to safely write integer values with correct endianness conversion. This makes the code consistent with the validation pattern introduced with the rework of the xcrb_msg_to_type6_ep11cprb_msgx() function.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing</p> <p>The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and security concerns: 1. Struct overlay approach (pld_hdr) assumes fixed payload structure and doesn&#39;t validate the actual ASN.1 encoding. 2. Complex length format detection logic is error-prone and doesn&#39;t properly validate bounds at each parsing step. 3. Direct struct member access bypasses proper ASN.1 validation.</p> <p>Fix by replacing struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, optional domain tag/length/value) with proper bounds checking at every step. Add asn1_int_encode() helper function to safely write integer values with correct endianness conversion. This makes the code consistent with the validation pattern introduced with the rework of the xcrb_msg_to_type6_ep11cprb_msgx() function.</p> https://vulnerability.circl.lu/vuln/cve-2026-80544