In the Linux kernel, the variable ev, set by userspace through event->attr.config, is used as an array index after bounds checking but without a speculative execution barrier. The missing array_index_nospec call allows the CPU to speculatively access array elements outside the intended bounds, creating a Spectre‑type side‑channel that could leak sensitive kernel data. Consequently an attacker with the ability to configure perf events could deduce confidential information through the speculative execution path.

All Linux kernel versions that contain the vulnerable s390/perf_cpum_cf code and have not yet received the patch that restores proper speculation protection are affected. The flaw applies to any distribution shipping an unpatched kernel containing the referenced commit; no specific version range is listed, so any earlier kernel with this code is at risk.

The vulnerability can be exploited by local users who can set perf event configurations, providing a straightforward attack surface. The EPSS score of < 1% and the CVSS score of 5.5 indicate moderate likelihood and moderate severity, while the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to trigger a speculatively executed out‑of‑bounds read and to observe the resulting microarchitectural changes. Given the CVSS score and attack vector, immediate action is recommended.