The bug occurs in the Linux kernel’s KVM s390 PCI AIF support, where the code mistakenly multiplies a GAIT table index with the size of its element, resulting in a double‑scaled offset. This causes out‑of‑bounds reads when the index exceeds 31 on a system with 512 ZPCI devices. The flaw can lead to memory corruption, which may compromise system integrity or cause a denial of service if exploited by an attacker with sufficient privileges.

All Linux kernel deployments that include the KVM s390 PCI AIF code and are running prior to the commit that removes the erroneous sizeof multiplication. The affected kernel is the general Linux kernel, with no specific vendor or product version information provided.

The CVSS score is not listed in the data, and the EPSS score is not available, indicating limited public information about exploitation potential. The vulnerability is not currently listed in the CISA KEV catalog. Because the flaw requires kernel‑level access to the execution context—typically only available to privileged users or through manipulation of host configuration—it is unlikely to be widely exploitable without elevated privileges. Nonetheless, unpatched systems should be updated promptly to eliminate the risk.