CVE-2026-97589 Linux CVE debrief

Who should care

Defenders and administrators responsible for Linux kernel systems, especially those utilizing s390/crypto functionalities, should assess exposure and prioritize patching to mitigate potential risks.

Why it matters

CVE-2026-97589 is a vulnerability in the Linux kernel's s390/crypto implementation that can cause a double completion of cryptographic requests. Defenders should prioritize verifying and applying patches, reviewing system configurations, and monitoring system logs to mitigate potential risks.

• Verification of patch application is required to prevent potential double completion of cryptographic requests
• Monitoring system logs for indicators of exploitation or undefined behavior is necessary
• Reviewing system configurations and cryptographic request handling is recommended

Technical summary

The Linux kernel's s390/crypto implementation has a vulnerability that can cause a double completion of cryptographic requests. This occurs when the do_one_request callback returns a negative error code instead of 0 after explicit finalization of a request, potentially leading to undefined behavior. Fixes have been applied to the affected callbacks in paes_s390.c and phmac_s390.c. The vulnerability affects Linux kernel systems utilizing s390/crypto functionalities. Defenders should prioritize verifying and applying patches for Linux kernel versions impacted by this vulnerability, particularly in environments utilizing s390/crypto functionalities. The CVE record and NVD entry provide details on the vulnerability

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions impacted by this vulnerability, particularly in environments utilizing s390/crypto functionalities.

Recommended defensive actions

• Verify and apply patches for Linux kernel versions impacted by this vulnerability
• Review system configurations and cryptographic request handling
• Monitor system logs for potential indicators of exploitation
• Perform a thorough review of the system's cryptographic request handling to identify potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected components. However, specific version ranges and potentially affected systems require further verification from official Linux kernel sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.