The s390/vfio_ccw driver in the Linux kernel contains an off‑by‑one loop in ccwchain_calc_length() that reads a 257th channel command word outside the bounds of the CCW array. This out‑of-bounds read can expose kernel memory contents or cause a crash, representing an information‑disclosure or denial‑of‑service flaw.

All Linux kernel builds that include the s390/vfio_ccw driver and run on IBM Z (s390) hardware are affected until the commit that restructures the loop is applied. No specific release numbers are given, so any configuration containing the vulnerable driver code, regardless of kernel version, is impacted.

The CVSS score is not provided, and the EPSS score is unavailable; the vulnerability is not listed in the CISA KEV catalog. The flaw requires local or device-level access to supply malformed channel programs to the vfio_ccw interface, so an attacker who can execute code in that context could trigger the out-of-bounds read and potentially leak kernel data. Because the attack vector is limited to privileged users or system administrators, the immediate risk is moderate pending a patch, but elevated if the driver is exposed to untrusted code.