In the Linux kernel, a bug in the handling of the _PAGE_UNUSED page‑table entry (pte) bit caused pages that were actually in use to be mistakenly marked as unused. When these pages were subsequently unmapped, they were evicted and discarded as if they were spare, leading to corruption of data inside virtual machines. This flaw involves incorrect state management of memory mapping in the kernel and can result in loss of guest data integrity. The vulnerability is a classic example of improper handling of resource state, which is captured by CWE‑727 and CWE‑908.

The defect affects all Linux kernel builds that employ the s390 architecture, from earlier releases up to the current stable kernel in which the patch is applied. No specific sub‑versions are listed, so any s390‑based host running the kernel before the upstream commit is considered vulnerable. The issue surfaced in the virtualization layer, notably KVM, impacting guests that rely on the kernel to manage memory pages.

The CVSS score and EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread exploits are currently known. However, the flaw requires local privileged access to the affected host – either through user escalation or exploits that gain kernel code execution. Once reached, an attacker can trigger guest memory corruption, potentially leading to application crashes or, in extreme cases, further compromise of the guest process space. Due to the lack of publicly known exploits, organizations should still treat this as a noticeable risk, especially for systems running s390 architectures or KVM guests.