The vulnerability resides in the Linux kernel’s KVM subsystem for the IBM s390 architecture, where the account_mem() and unaccount_mem() functions call get_uid() to increment a user_struct reference count without ever calling free_uid(). When pages are unpinned, the unaccount_mem() function may run in a different process context, causing stale references to remain. It is inferred that this mis‑accounting can cause a memory leak in the kernel, eventually exhausting available memory and leading to system instability or a denial of service. The weakness corresponds to potential misuse of kernel structures (CWE-911).

This issue affects all Linux kernel builds that include the buggy KVM implementation on the s390 architecture. Distributions shipping the base kernel with the affected KVM code are impacted. No other vendors or products are listed in the CNA data.

The CVSS score of 5.5 places the vulnerability in the medium severity range, and the EPSS score of less than 1% indicates a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, and no publicly documented exploits exist. Exploitation would likely require privileged access to a KVM domain or a heavily loaded virtualization environment where many PCI‑passthrough VMs trigger frequent pinning and unpinning of pages. While the path to exploitation is constrained to kernel‑level operations, prolonged mis‑accounting could still result in memory exhaustion over time.