Uninitialized memory in the KVM S390 function kvm_s390_get_cmma_bits() allows the kernel to return stale data on the KVM interface. The returned buffer is allocated with vmalloc, which does not zero memory, and only pages marked as dirty are written. Gaps in the span remain uninitialized, and a copy_to_user() operation copies these gaps back to user space, exposing parts of kernel memory. The primary impact is that an attacker can read portions of kernel memory, potentially revealing sensitive data and enabling further attacks such as privilege escalation or data exfiltration.

This issue affects Linux kernel implementations that include the KVM S390 module, specifically the kvm_s390_get_cmma_bits() implementation. All affected users of Linux kernel running the KVM driver on the s390 architecture are potentially vulnerable, regardless of distribution, provided the module is loaded.

The vulnerability is local, requiring access to the KVM interface (typically through /dev/kvm). The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The risk hinges on the presence of a privileged KVM user who can invoke the offending ioctl. The CVSS score of 5.5 indicates a moderate disclosure risk, but the information disclosure is significant enough to warrant immediate remediation, especially in environments where kernel memory confidentiality is critical.