Based on the description, it is inferred that the s390/zcrypt driver previously relied on fragile struct overlays for the EP11 CPRB payload. This approach omitted proper ASN.1 validation and bounds checking, allowing a crafted message to cause an out‑of‑bounds write in kernel memory. The resulting corruption could lead to arbitrary kernel data modification, potentially enabling privilege escalation or denial of service.

The vulnerability affects any Linux kernel that incorporates the s390/zcrypt driver and has not yet integrated the upstream patch addressing the EP11 CPRB domain handling. This includes all current s390 architecture kernels prior to the patch commitment, irrespective of distribution. The flaw is specific to the Linux kernel's s390 implementation and is not tied to any third‑party vendor.

The CVSS score of 7.8 indicates a high‑severity issue. The EPSS score of less than 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog, implying no publicly documented attacks. Based on the description, it is inferred that the likely attack vector is local or requires privileged execution, as the malicious EP11 CPRB payload must be directed to the zcrypt device. Until an exploit appears, the risk remains high for systems running vulnerable kernels, but the practical exploitation window appears narrow.