In the Linux kernel, the vfio-ccw subsystem processes channel programs recursively. Because of this recursion, there is an arbitrary limit on the number of Command Control Words (CCWs) that can exist in a single channel program. The current implementation fails to impose a strict, architectural limit on the number of segments, which can lead to excessive memory consumption or stack overflow when a program contains many segments. This flaw could be exploited to cause a denial of service in systems that use vfio-ccw devices.

The vulnerability affects the Linux kernel, specifically the vfio-ccw driver. Any system running a Linux kernel without the fix that limits the number of CCW segments is potentially affected. The CVE does not list specific kernel versions, so any kernel build that includes this code before the patch is at risk.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploitation would require privileged execution or a user with the ability to configure or interact with vfio-ccw devices, making the threat moderate but potentially impactful if such access is gained.