The vulnerability arises in the s390/zcrypt subsystem of the Linux kernel. The cca_ecc2protkey() function derives the amount of data to copy for a CPRB parameter block directly from a length field supplied in the key token. If that length exceeds the size of the buffer reserved for the request’s parameter block, the function copies more data than the buffer can hold. This unchecked copy can corrupt kernel memory, potentially leading to crashes or privilege escalation.

All Linux kernel kernels that include the s390/zcrypt module and lack the length‑validation patch are affected. This applies to every distribution and kernel build compiled for the s390 architecture; the CNA lists only the kernel itself, and no specific version ranges are provided, so any kernel older than the patched release may be vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% suggests low likelihood of exploitation as of the latest data. The vulnerability is not listed in CISA KEV. An attacker would need to supply a malformed ECC private‑key token and trigger the kernel’s cryptographic API, which normally requires local or privileged access. No public exploit has been disclosed.