The Linux kernel for the s390 architecture contains an unchecked syscall number that can be supplied directly by userspace. Because no array_index_nospec boundary is applied, a crafted syscall number may result in an out‑of‑bounds read of the syscall function pointer table. While the CVE description does not confirm that an attacker can read arbitrary kernel memory, the missing boundary check allows data outside the intended table to be accessed, and based on the description it is inferred that this could potentially expose information to the process owning the crafted request.

All Linux kernel builds running on the s390 platform that include versions from 5.12 onward, including the 7.0 release candidates, are affected until the patch that adds the spectre boundary is merged. No other architectures or kernel releases are listed as impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1 % denotes a very low likelihood of exploitation, and the vulnerability is not present in the CISA KEV catalog. The attack is feasible from any userspace process on an s390 system, which can supply a crafted syscall number to trigger the out‑of‑bounds read. The CVE data does not provide evidence that the read leads to a broader data disclosure, but based on the description it is inferred that the out‑of‑bounds region could contain sensitive kernel data, making disclosure possible.