CVE-2026-31746CWE-401

CVE-2026-31746

Medium · published May 1, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Fix memory leak with CCA cards used as accelerator

Tests showed that there is a memory leak if CCA cards are used as

accelerator for clear key RSA requests (ME and CRT). With the last

rework for the memory allocation the AP messages are allocated by

ap_init_apmsg() but for some reason on two places (ME and CRT) the

older allocation was still in place. So the first allocation simple

was never freed.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-05-01T19:16Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 6.16, < 6.18.226.18.22
linux/linux_kernel≥ 6.19, < 6.19.126.19.12
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
https://git.kernel.org/stable/c/1650268579e1113b30402dbcca4dba6589a0fccf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/586222c37d4027dbf60a604fbe820184fee7c1c9 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ace37bfec3822033e59fff390f2ff99fc96ebe4f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c8d46f17c2fc7d25c18e60c008928aecab26184d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 01 MAY 14:14Z
    s390/zcrypt: Fix memory leak with CCA cards used as accelerator
    cvelistv5