The Linux kernel s390/zcrypt subsystem copies a user‑supplied message into a kernel buffer using the supplied length, but subsequent processing expects the buffer to be 4 bytes larger. As a result, up to three bytes of uninitialised kernel memory are forwarded to the crypto card firmware, potentially leaking sensitive kernel data to the device. This flaw enables unintended exposure of kernel memory and could allow an attacker to read or infer confidential information from the kernel space.

All Linux kernel builds that include the s390/zcrypt module are affected. No specific version range is provided, so any kernel that compiles this subsystem should be reviewed for the presence of the patch. The vulnerability applies to both the CCA and EP11 cryptographic card interfaces.

The vulnerability is not listed in the CISA KEV catalog and EPSS data is unavailable, indicating a low or undetermined exploitation probability. An attacker would need local access to the zcrypt interface to send a crafted message that triggers the uninitialized memory leak. The attack vector is inferred to be local, via the kernel’s crypto device interface. Once exploited, the attacker could read fragments of kernel memory, providing information that might aid further attacks or compromise system integrity.