The vulnerability resides in the xcrb_msg_to_type6cprb_msgx() function within the s390/zcrypt driver. The function performs integer overflow checks during CEIL4 alignment, copies the CPRBX structure from userspace without verifying its size, and adds control and data block sizes without guarding against arithmetic overflow. These omissions can lead to undersized buffer allocations, uninitialized memory reads of fields such as cprbx.cprb_len and cprbx.domain, and eventual buffer overflow. An attacker who can supply crafted input to the driver would therefore be able to corrupt kernel memory, potentially enabling arbitrary code execution or system compromise.

All Linux installations that incorporate the s390/zcrypt driver before the apply of the 2026-80546 patch are affected. The vulnerability does not specify a particular kernel version range, but it applies to any kernel in which the unsanitized function remains present. Consequently, all unmodified Linux kernels shipped by vendors that include the zcrypt module and expose this functionality are vulnerable.

Official severity metrics such as CVSS, EPSS, or KEV are not available for this vulnerability, indicating that a formal score has not yet been assigned and no publicly documented exploitation has been reported. Nevertheless, buffer overflow in a kernel driver is generally regarded as a high-risk condition. Exploitation would likely require local or elevated privileges to interact with the zcrypt device; a compromised process could feed malicious data to trigger the overflow, leading to kernel memory corruption and potentially privilege escalation. In the absence of known public exploits, organizations should treat this as a significant local-privilege escalation risk pending a security release.