In the Linux kernel for the s390 architecture, a memory leak exists in the zcrypt subsystem when CCA cards are used as accelerators for clear-key RSA requests in ME and CRT modes. The flaw arises because memory allocated by ap_init_apmsg() is never freed in these code paths, causing persistent kernel memory consumption each time such requests occur. This is a CWE-401 and CWE-772 flaw that can exhaust kernel RAM, leading to system instability or a full denial of service.

Any Linux kernel running on s390 hardware that employs CCA card acceleration for RSA clear-key operations is affected. The advisory does not specify exact kernel versions, so all builds containing the unpatched zcrypt code for the ME or CRT pathways are potentially vulnerable.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation but an inherent risk if the flaw is present. The CVSS score of 5.5 indicates a moderate severity. The CWE-401 and CWE-772 flaws cause a memory leak when CCA cards process clear-key RSA requests in ME and CRT modes, allowing an attacker to repeatedly trigger the leak via repeated RSA requests. This can exhaust kernel memory, lead to crashes, or otherwise render the system inoperable.