A flaw in the Linux kernel’s s390 architecture allows a userspace process to control the syscall number and bypass an array_index_nospec boundary, enabling a speculative execution path that can read arbitrary kernel memory. This results in a confidentiality compromise consistent with a Spectre variant, allowing an attacker to potentially expose sensitive information such as passwords, cryptographic keys, or other memory contents. The vulnerability is a classic out‑of‑bounds read that can be exploited through speculative execution to leak data to the attacker without modifying the kernel state.

All Linux kernel versions running on the s390 architecture are affected because no version information is specified. The issue applies to the generic Linux kernel on s390, regardless of distribution, until the patch adding a spectre boundary is incorporated.

The CVSS score is not provided and the EPSS score is unavailable, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: any userspace process on an s390 system can pass a crafted syscall number to trigger the out‑of‑bounds access. Because the flaw relies on speculative execution and lacks proper bounds checks, it is considered a high‑risk vulnerability until a kernel update is applied.