The Linux kernel's memtop_get_page_count function on the s390 architecture uses a user‑controlled parameter 'level' to index a static array. Because the code omitted a call to array_index_nospec, speculative execution could allow the kernel to read memory beyond the bounds of that array before the bounds check is enforced. This missing guard permits a locally‑privileged user to influence memory accesses that may be captured via a side‑channel, effectively leaking sensitive kernel data. The vulnerability thus represents an information‑disclosure flaw that leverages speculative execution techniques, identified as a bounds‑checking weakness.

All Linux kernel installations that compile the s390/diag code, specifically the s390 architecture. The vulnerability is present in any kernel version that has not been patched by the commit that adds the array_index_nospec call. No specific upstream release version is listed, so all earlier kernel releases that include the unpatched memtop_get_page_count function are affected.

The flaw is a local, kernel‑level vulnerability that requires the attacker to have user space access on the same machine. The missing speculative execution guard can be triggered by passing a crafted 'level' value to the diag interface, causing out‑of‑bounds reads that may expose kernel memory contents. While no CVSS score is supplied, the defect would be evaluated as high severity due to its local privilege escalation potential for data disclosure. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation has not yet been observed. Nevertheless, the existence of the vulnerability warrants prompt patching.