The kernel’s vfio_ccw driver on the s390 architecture contains a race condition between the io_mutex and I/O operations. The mutex originally guarded only io_regions, but it was also synchronizing I/O themselves, creating narrow windows where concurrent access could corrupt shared kernel data structures. The patch expands the mutex scope to cover all I/O resources, preventing the race and the resulting kernel instability that could lead to a denial of service.

The flaw resides in the Linux kernel for s390 hardware. Any installation running a kernel version that predates the commit that applies the patch (identified by the hash 2a5ac0c0f1f7da33929211a2e41911bf72ee35d8) is vulnerable. This includes all conventional builds of Linux for the s390 architecture that have not incorporated that change.

The vulnerability is scored with a CVSS of 8.8, marking it as a high‑impact flaw. Its EPSS score is reported as less than 1% at the time of analysis, indicating a very low likelihood of active exploitation. It is not listed in CISA’s KEV database. The attack path is local: an attacker must have code execution with kernel or root privilege to trigger the race, such as through a malicious driver, privilege escalation exploit, or by loading a custom module that interacts with vfio_ccw.