CVE-2026-68385 s390/checksum: Fix csum_partial() without vector facility
A null pointer dereference in the s390 checksum implementation on systems without vector facilities can cause a kernel crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68385?
CVE-2026-68385 is a critical vulnerability in Linux, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/checksum: Fix csum_partial() without vector facility
Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. On machines without the vector facility, csum_copy() falls back to cksm(dst, ...), causing the checksum to be calculated from address zero instead of the source buffer.
The VX implementation already checksums data loaded from src. Make the fallback do the same by passing src to cksm().
Weakness: CWE-476
Which versions are affected by CVE-2026-68385?
How do I fix CVE-2026-68385?
Apply the vendor's patch.
Is CVE-2026-68385 being exploited?
There is no known exploitation of CVE-2026-68385 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68385, DEBIAN-CVE-2026-68385, GHSA-p69g-gmqr-g4rm, UBUNTU-CVE-2026-68385.