The vulnerability is a buffer over‑read in the Linux kernel s390/zcrypt subsystem, corresponding to CWE‑125. The cca_check_sec*token functions read user‑supplied length fields without validating them against the actual buffer size or the minimum token structure size. This flaw can cause the kernel to read beyond the bounds of the key buffer during CCA token processing, potentially triggering a kernel crash or exposing memory contents through the cryptographic card interface. The weakness corresponds to improper input validation and a buffer over‑read.

All builds of the Linux kernel that include the s390/zcrypt subsystem are susceptible, as the CNA data lists Linux:Linux for both vendors. The specific affected product is the Linux Kernel from the Linux Foundation. No version ranges are provided; therefore, any kernel version prior to the commit that introduced the fix should be considered vulnerable until updated.

The CVSS score is 7.1, and the EPSS score is unavailable, but the potential for a crash or information disclosure indicates a moderate to high severity. The flaw is likely exploitable in a local context where an attacker can send crafted requests to the kernel crypto card interface; remote exploitation would require privileged access or physical access to the hardware. The vulnerability is not listed in CISA’s KEV catalog, so no confirmed public exploits exist at this time.