The Linux kernel function handling EP11 CPRB data performs no minimum size validation of the ep11_cprb structure and its payload before copying from userspace, and uses arithmetic that can overflow during alignment calculations. This omission results in a buffer overflow (CWE‑119) and an integer overflow (CWE‑190), allowing an attacker to supply a crafted EP11 CPRB message that overflows a kernel buffer, potentially leading to arbitrary code execution or privilege escalation. The vulnerability arises from lack of bounds checking and improper handling of ASN.1 encoded payloads, which together expose the kernel to memory corruption attacks. In the absence of defensive checks, any user able to construct such a message for the EP11 device can trigger the overrun.

The flaw is present in all Linux kernel builds that include the s390/zcrypt module before the commit that added proper length and overflow checks. This includes generic distributions running the default kernel on s390 architecture, regardless of vendor. Since the patch is in the kernel source, any system that has not yet upgraded to the fixed version is potentially affected.

The risk level is high because the flaw resides in the privileged kernel space and can lead to full control over the affected machine. The exploit requires the creation of a malformed EP11 CPRB message, which can be done through userspace code that communicates with the s390 crypto subsystem. While the EPSS score is unavailable, the nature of the vulnerability and the lack of any mitigations in the kernel suggest that attackers could achieve local privilege escalation or remote code execution if they can send the payload to the kernel. The vulnerability is not listed in the CISA KEV catalog, but its potential impact warrants immediate remediation.