[SRU][R/N:hwe-6.17/N][PATCH 0/3] CVE-2026-68451

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-68451

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Validate length for CCA ECC private key requests

cca_ecc2protkey() derives the copy length for the CPRB parameter block directly
from the length field in the key token. Reject the request early if the token
length exceeds the available space in the parameter block.

[ Fix ]

resolute/linux: clean cherry-pick of a9ae0f6dd45c
noble/linux-hwe-6.17: clean cherry-pick of a9ae0f6dd45c
noble/linux: backported from a9ae0f6dd45c; backported to noble/linux; review and refine this note

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

The fix adds an early length check in cca_ecc2protkey() so that a key token
whose length field exceeds the space available in the CPRB parameter block is
rejected before the copy. If the added bound were computed too strictly, valid
CCA secure ECC private keys could be refused, breaking protected-key derivation
for workloads on IBM Z (s390x) that use the pkey/zcrypt interface together with
a CCA cryptographic coprocessor (CEX adapter). Systems on other architectures,
and s390x systems that do not convert CCA secure ECC private keys through pkey,
are not affected.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: 9da444a0/v1