The issue resides in the s390 monwriter subsystem of the Linux kernel. When a user‑space program reuses data buffers for interval sample records, the first record defines the data length used for copying data into a kernel buffer, and the code does not verify that later records use the same length. An attacker can modify a subsequent record’s data length, causing an out‑of‑bounds copy into kernel memory. This results in kernel memory corruption. While this flaw does not directly grant code execution, corrupted memory can be leveraged by an attacker with sufficient privilege to achieve privilege escalation or other malicious outcomes.

All Linux kernel builds that target the s390 architecture and include the monwriter misc device prior to the upstream commit are affected. This encompasses virtually all major distribution kernels for s390 that have not been patched with commit 01f3ce4117… or its downstream equivalent. Any vendor delivering s390 kernel packages remains at risk until the patch is applied.

The vulnerability is a memory‑corruption flaw with no published CVSS score and an unavailable EPSS score; it is not listed in the CISA KEV catalog. Exploitation requires local access to /dev/monwriter, which by default is owned by root and not world‑writable. Thus, an attacker would need root or the ability to elevate privileges to exploit the flaw. The risk is considered low for deployments that have not changed the device’s permissions, but the potential for privileged memory corruption warrants prompt patching.