CVE-2026-97589 s390/crypto: Fix wrong return code to engine in asynch callbacks
Incorrect return codes in s390 crypto drivers cause double completions, potentially leading to system instability or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97589?
CVE-2026-97589 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/crypto: Fix wrong return code to engine in asynch callbacks
When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0 to indicate successful handling. Returning a negative error code causes the crypto engine to assume the driver failed to take ownership and triggers a second completion via crypto_request_complete(), resulting in a double completion. This pattern occurs in paes_s390.c 4 times and once in phmac_s390.c.
Fixed in phmac_do_one_request() and all four paes do_one_request callbacks (ecb, cbc, ctr, xts) by returning 0 after explicit finalization instead of propagating the error code.
Which versions are affected by CVE-2026-97589?
How do I fix CVE-2026-97589?
Apply the vendor's patch.
Is CVE-2026-97589 being exploited?
There is no known exploitation of CVE-2026-97589 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97589, DEBIAN-CVE-2026-97589, GHSA-x8r8-vhc5-qmvr, UBUNTU-CVE-2026-97589.