CVE-2026-97588 s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly
A flaw in the Linux kernel s390 crypto driver causes indefinite blocking when hardware key conversion fails repeatedly, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97588?
CVE-2026-97588 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly
When hardware persistently returns -EBUSY after exhausting retries, the error propagates to crypto_finalize_*_request(). The crypto API's completion wrapper treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing. This causes callers using crypto_wait_req() to block indefinitely.
Translate persistent -EBUSY to -EIO after retry exhaustion to ensure proper error propagation and callback invocation.
Which versions are affected by CVE-2026-97588?
How do I fix CVE-2026-97588?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97588 being exploited?
There is no known exploitation of CVE-2026-97588 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97588, DEBIAN-CVE-2026-97588, GHSA-h4f3-gqwc-8q2q, UBUNTU-CVE-2026-97588.