In the Linux kernel for the s390 architecture, a memory leak exists in the zcrypt subsystem when CCA cards are employed as accelerators for clear‑key RSA requests using the ME and CRT modes. The flaw occurs because a prior allocation performed by ap_init_apmsg() is never deallocated in these code paths, causing persistent kernel memory usage each time such requests are processed. The result is uncontrolled consumption of kernel RAM, which can lead to system instability or a complete denial of service as memory resources are exhausted.

Systems running a Linux kernel on s390 hardware that utilize CCA card acceleration for RSA clear‑key operations are affected. The specific kernel versions are not listed in the advisory, but any build that incorporates the unpatched zcrypt code for ME or CRT pathways may be vulnerable.

The CVSS score is not provided, and the EPSS metric is unavailable, which suggests the current publicly known exploitation likelihood is uncertain. Nonetheless, because the vulnerability can be triggered by normal kernel operation of zcrypt via user‑space applications that initiate clear‑key RSA requests, an attacker who can force repeated requests could deplete kernel memory and cause a denial of service. The flaw is listed as not being part of the CISA KEV catalog, indicating no known active exploitation but still a significant risk if the vulnerability is present.