A race condition exists in the VFIO‑CCW driver on IBM s390 systems because the list of CRW payloads is accessed without a lock. The missing synchronization can cause the kernel to read an inconsistent state during the processing of asynchronous hardware events, potentially leading to kernel crashes, data corruption, or other unexpected behavior. The flaw is classified as CWE‑413 and carries a CVSS score of 8.8, indicating a high severity of potential impact on system stability.

Linux kernels on IBM s390 architecture that include the VFIO‑CCW driver and have not yet been updated to include commit 16b0798024c0e9117e395829ddbbe70981c79d9c are affected. The change introduces a lock that protects the CRW payload list; older kernels lack this protection.

The EPSS score is listed as less than 1 %, showing a very low probability of current exploitation, and the vulnerability is not in CISA’s KEV catalogue. Based on the description, it can be inferred that an attacker would need local access to trigger concurrent asynchronous events or otherwise manipulate the CRW list, so the risk is primarily limited to environments that expose VFIO‑CCW to untrusted devices or users. The high CVSS score, however, means that a successful exploitation could severely destabilize the kernel.