The Linux kernel’s vfio_ccw driver on the s390 architecture performed cleanup of private CP resources while holding the subchannel’s CIO lock when the device was reported lost. This race condition can lead to a deadlock or a crash, interrupting kernel operation and potentially halting the entire system. The flaw is a concurrency issue compounded by improper resource cleanup (CWE‑833).

This deficiency applies to any Linux kernel running on s390 that has not integrated the patch from the cited commits. The vulnerable component is the vfio_ccw driver within the Linux kernel. Versions prior to the included commits are affected; the kernel itself is the vendor product on the s390 architecture.

The CVSS score of 8.2 signifies high severity. The EPSS score is < 1 %, so exploitation is considered very unlikely at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves local or privileged access that can cause the target device to become lost or trigger the cleanup path; such conditions would allow an attacker to induce the race, causing a deadlock or kernel crash. After applying the patch, the race is removed and the risk is eliminated.