The flaw causes the kernel's checksum routine to calculate a checksum on memory address zero instead of the intended source buffer on s390 processors without vector support. Because the checksum is used to validate network packets and other data, this mis‑calculation can result in invalid packet checksums, leading to dropped or corrupted data. The defect does not reveal data directly, but undermines data integrity and may impair service reliability.

Any Linux kernel running on s390 hardware that lacks the vector facility and that has not yet been updated with the upstream commit that addresses csum_partial() is affected. The bug applies to all kernel versions prior to the fix but does not exist in kernels updated after the patch has been merged.

The CVSS score is not available, the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The bug resides in core checksum logic and could be triggered by network traffic that forces the kernel to perform a checksum on a packet; no local privilege escalation is required. This implies an attacker with the ability to send crafted packets to a vulnerable system could exploit the flaw, potentially causing packet loss or service disruption. The exact exploitability depends on whether the target processes the affected checksums and on the specific configuration of the system.