This vulnerability allows a user-controlled domain value extracted from an ioctl structure to be used as an array index in the s390/zcrypt subsystem after bounds checking but without a speculation barrier. The missing speculation barrier can lead to speculative memory reads that may expose sensitive kernel data, effectively leaking information to the user who has sufficient control over the device node. The flaw is a typical example of a speculative execution vulnerability and does not directly lead to code execution or privilege escalation but compromises confidentiality by exposing data that should remain hidden.

The flaw resides in the Linux kernel, affecting any kernel version that implements the s390/zcrypt subsystem without the defensive ‘array_index_nospec’ call. No specific version range is listed in the CNA data, so all kernels that have not incorporated the patch are considered vulnerable. Systems using custom device nodes or running administrative workload on the zcrypt device can trigger the flaw during CPRB processing.

Exploitability requires the ability to invoke the relevant ioctl on the s390/zcrypt device and to provide a crafted domain value that causes out-of-bounds speculation. The attack is local to the system, but once executed it can leak kernel data to the attacker. The EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 5.5, indicating moderate severity, and the presence of speculative execution and potential data leakage indicates a moderate severity risk for compromised confidentiality. Affected hosts should therefore act promptly to apply the kernel patch that adds the necessary speculation barrier.