Description

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0 to indicate successful handling. Returning a negative error code causes the crypto engine to assume the driver failed to take ownership and triggers a second completion via crypto_request_complete(), resulting in a double completion. This pattern occurs in paes_s390.c 4 times and once in phmac_s390.c. Fixed in phmac_do_one_request() and all four paes do_one_request callbacks (ecb, cbc, ctr, xts) by returning 0 after explicit finalization instead of propagating the error code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-25T11:17:10.103Z",
  "pubdate": "2026-09-25T11:17:10.103Z",
  "executiveSummary": "This vulnerability involves an improper error handling condition within the Linux kernel s390 cryptographic subsystem.\nThe flaw manifests as a double completion of asynchronous cryptographic requests, specifically affecting the paes_s390 and phmac_s390 drivers.\nBy incorrectly returning a negative error code after explicitly finalizing a request, the driver triggers an erroneous state where the crypto engine attempts to finalize the same request a second time.\nThis logic error constitutes a race condition or a state inconsistency that can lead to memory corruption, system instability, or kernel panics.\nThe issue affects the internal crypto engine interaction flow within s390 hardware acceleration modules.\nSuccessful exploitation or triggering of this condition requires local access to execute cryptographic operations that invoke the affected s390 drivers.\nThe risk is primarily identified as a denial-of-service vector due to the likelihood of kernel panics following the double completion event.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of return codes within the 'do_one_request' callback functions of the s390 cryptographic drivers, specifically within 'paes_s390.c' and 'phmac_s390.c'.\nIn the Linux kernel's asynchronous cryptographic framework, when a request is processed by 'do_one_request', the crypto engine expects the driver to either handle the request and return 0 (signifying success/ownership transfer) or return a negative error code if the driver failed to process the request.\nIf the driver executes 'crypto_finalize_hash_request()' or 'crypto_finalize_skcipher_request()' internally, the request is marked as complete. If the driver subsequently returns a negative error code to the caller, the crypto engine interprets this as a failure to take ownership or a processing error.\nUpon receiving this negative code, the engine invokes 'crypto_request_complete()' to perform cleanup and finalization. Because the driver has already finalized the request, this secondary invocation constitutes a double completion.\nThe attack flow involves: 1. A user-space or kernel-level process submits a cryptographic request to the affected s390 driver (ECB, CBC, CTR, or XTS mode for paes; or phmac). 2. The driver processes the request and executes the finalization function, signaling the completion to the kernel crypto API. 3. The driver mistakenly returns a non-zero (negative) error status to the engine. 4. The crypto engine, believing the driver failed, proceeds to call completion routines on an already-freed or already-finalized data structure.\nThis triggers a memory safety violation, potentially leading to a use-after-free or a kernel panic as the crypto engine attempts to perform operations on a request object that is no longer in a valid state.\nThe affected components are the paes_s390 and phmac_s390 hardware acceleration modules. Exploitation typically requires the ability to initiate cryptographic transformations using these specific modes on the s390 architecture. This is a local vulnerability where an attacker with the ability to trigger these specific cryptographic paths can cause a system crash, effectively resulting in a denial-of-service condition."
}