The vulnerability is a race condition in the vfio_ccw driver for Linux on the s390 architecture. The io_mutex was originally intended to serialize access to io_regions but has been inadvertently tied to other I/O resources as well. Because the mutex scope was too narrow, a handful of race windows remained, allowing concurrent manipulation of shared I/O state. The applied patch expands the mutex scope to cover all I/O resources, eliminating the race windows and preventing potential kernel corruption or denial of service.

Affected systems are all Linux kernel distributions running on the s390 architecture that are built with a kernel version prior to the commit that introduced the patch. The change is found in commit 2a5ac0c0f1f7da33929211a2e41911bf72ee35d8 and subsequent commits. Administrators should ensure the kernel has been updated to a version that includes this commit.

Risk is undetermined by a published CVSS score; the EPSS metric is not available and the vulnerability is not in the CISA KEV list, suggesting no known public exploitation yet. Because the flaw resides in the kernel's synchronization primitives, an attacker would need to execute code with root or kernel privileges, possibly via a malicious module or privilege escalation, to trigger the race. Nonetheless, the potential for kernel corruption or denial of service makes the risk significant for systems exposed to this race window, though the exploitability window is narrow.