The vulnerability resides in the Linux kernel’s s390/zcrypt module, where the function that processes EP11 CPRB messages fails to validate the minimum size of the ep11_cprb structure and its payload before copying data from userspace. It also performs alignment calculations with an arithmetic expression that can overflow, allowing a crafted message to overflow a kernel buffer. This leads to memory corruption in privileged kernel space, which an attacker can exploit to gain elevated privileges or execute code within the kernel context. The impact is fully local: only a user able to construct a malicious EP11 CPRB payload can trigger it, but the resulting kernel compromise can grant system‑wide control.

All Linux kernel releases that include the s390/zcrypt driver on the s390 architecture before the commit adding explicit length and overflow checks are affected. Based on common deployment patterns, it is inferred that this includes IBM System z. This encompasses mainstream distributions deploying the standard kernel for s390. Any system still running an unpatched kernel that processes EP11 CPRB messages is potentially vulnerable.

The CVSS score of 7.8 reflects a high severity for a kernel flaw that allows privilege escalation. The EPSS score is 0.00136 ( < 1%), indicating a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. The attack vector is local: an attacker must be able to send a malformed EP11 CPRB message to the kernel via the s390 crypto subsystem. While exploitation complexity is moderate due to the need for specific payload construction, the potential payoff—kernel‑level compromise—warrants prompt remediation.