The flaw originates from incorrect handling of the _PAGE_UNUSED bit in the s390 architecture’s page table entries. The bit is meant to indicate that a page can be discarded, yet KVM sets it on pages that are actually in use. Because the kernel clears the bit only in specific paths, other code paths left the bit set, causing pages that were still active to be treated as unused and evicted. This mismanagement of page state leads to corruption of the memory contents of the affected guest virtual machines, a classic example of resource state misuse (CWE‑911).

All Linux kernel releases that support the s390 architecture and were built before the upstream commit that added the fix for the _PAGE_UNUSED bit handling are vulnerable. The issue is specifically relevant for hosts running KVM guest instances on s390, where the kernel interacts with guest page tables.

The CVSS score is 9.3, indicating a severe impact, while the EPSS score is below 1%, showing a low likelihood of exploitation at the moment. The vulnerability is not listed in CISA's KEV catalog, and no publicly known exploits are available. The likely attack vector requires local privileged or kernel‑level access on the affected host; reaching kernel execution allows an attacker to provoke guest memory corruption by manipulating page mappings that incorrectly carry the _PAGE_UNUSED bit. The risk remains high due to the potential for data loss within virtual machines, but exploitation probability is modest given the current lack of widespread exploits.