CVE-2026-98387s390/crypto: Fix skcipher_walk return code handling in aes_s390
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk return code handling in aes_s390 The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, and attempting to process data could lead to incorrect behavior or accessing uninitialized memory. Add proper return code checking to ensure correct handling of the walk initialization and walk advance and eventually return to the caller with that return code.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
Linux Linux linux:linux (from the name) | 7988fb2c03c8cf9936f851ab19a6d21b3c3411c0 builds before 89b58645646d1dac34162cc2597f42266bfbf930; 7988fb2c03c8cf9936f851ab19a6d21b3c3411c0 builds before 35c3f97569306050e818fa18e17fa97c358f0f28; from 7988fb2c03c8cf9936f851ab19a6d21b3c3411c0 before aea3e1588f08e381a7a57b2bf1a60cc2347904cd; 7988fb2c03c8cf9936f851ab19a6d21b3c3411c0 builds before 15fa028589c3a2545f0bff355eff06d5844196bf | CNA record |
References
- https://git.kernel.org/stable/c/89b58645646d1dac34162cc2597f42266bfbf930
- https://git.kernel.org/stable/c/35c3f97569306050e818fa18e17fa97c358f0f28
- https://git.kernel.org/stable/c/aea3e1588f08e381a7a57b2bf1a60cc2347904cd
- https://git.kernel.org/stable/c/15fa028589c3a2545f0bff355eff06d5844196bf
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.