CVE-2026-68385

Received Received - Intake

s390 checksum calculation flaw in Linux kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without vector facility Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. On machines without the vector facility, csum_copy() falls back to cksm(dst, ...), causing the checksum to be calculated from address zero instead of the source buffer. The VX implementation already checksums data loaded from src. Make the fallback do the same by passing src to cksm().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68385

EUVD

EUVD-2026-55571

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's s390 checksum calculation. On systems without the vector facility, the csum_partial() function incorrectly calculates checksums from address zero instead of the actual source buffer. This happens because the fallback function cksm() receives NULL as the destination parameter, causing it to read from the wrong memory location.

Detection Guidance

This vulnerability affects the Linux kernel's s390 checksum calculation on systems without vector facility support. Detection requires checking kernel version and s390 architecture. Use uname -a to verify kernel and architecture. If running on s390x without vector facility, the issue may be present. No specific commands detect this beyond standard kernel checks.

Impact Analysis

This vulnerability could lead to incorrect checksums being generated for network packets or data transfers on affected systems. This might cause data corruption, failed integrity checks, or unexpected behavior in applications relying on accurate checksums.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel checksum calculation issue without implications for data privacy or security controls.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to resolve the issue. If using a vulnerable kernel version, upgrade to a patched version that includes the fix for s390 checksum calculation. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-68385. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70