CVE-2026-97589
Received Received - Intake

Double Completion Bug in Linux Kernel Crypto Engine

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0 to indicate successful handling. Returning a negative error code causes the crypto engine to assume the driver failed to take ownership and triggers a second completion via crypto_request_complete(), resulting in a double completion. This pattern occurs in paes_s390.c 4 times and once in phmac_s390.c. Fixed in phmac_do_one_request() and all four paes do_one_request callbacks (ecb, cbc, ctr, xts) by returning 0 after explicit finalization instead of propagating the error code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97589
EUVD
EUVD-2026-86897

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect return codes in asynchronous crypto callbacks. When certain crypto operations complete a request, they should return 0 to indicate success. Instead, they return negative error codes, which causes the crypto engine to incorrectly assume the driver failed and trigger a second completion. This leads to double completion of requests.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/crypto subsystem and does not have a direct network detection method. Detection requires checking the kernel version and examining the affected functions in paes_s390.c and phmac_s390.c for double completion issues.

Impact Analysis

This vulnerability could cause system instability or crashes due to double completion of crypto requests. It may lead to unexpected behavior in applications relying on crypto operations, such as encryption or hashing, potentially causing data corruption or security failures.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for this vulnerability. The issue is resolved by ensuring do_one_request callbacks return 0 after explicit finalization instead of propagating error codes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97589. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart