What’s Vulnerable › Vulnerabilities

CVE-2026-97588: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to crypto_finalize_*_request(). The crypto API's completion wrapper treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing. This causes callers using crypto_wait_req() to block indefinitely. Translate persistent -EBUSY to -EIO after retry exhaustion to ensure proper error propagation and callback invocation.

Affected products

• Linux kernel: 6.16 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/7a08507ea5b4d06ad8d269287913573f34467565
• https://git.kernel.org/stable/c/e267bd142664a181474112392aeaa8b3d4b12f2e
• https://git.kernel.org/stable/c/f6b263679aa72ad2e534bf93db55f2589549a40e

Get alerted when CVE-2026-97588 or the next vulnerability affects your stack