The vulnerability arises because the Linux s390/zcrypt subsystem did not scrub a temporary buffer used during clear‑key import. If key material is left in that buffer, a malicious process that can later read the same memory region may recover the clear key, effectively compromising the confidentiality of encrypted data. The flaw does not provide direct code execution or denial of service, but it exposes a sensitive secret that could be reused to decrypt data or forge cryptographic operations. The weakness is a form of information exposure through improper memory handling.

The issue affects the Linux kernel on s390 systems that use the zcrypt crypto module. Vendors identified are Linux:Linux, and the change applies to all kernel releases before the patch is merged. No specific version list is supplied, so any kernel that includes the vulnerable code path before the fix is potentially affected.

A CVSS score or EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the risk is significant for environments that rely on Linux kernel cryptographic functions for protecting sensitive data. The most likely attack vector is through a local process that can read memory after a clear‑key import; this requires sufficient privileges on the system. The patch introduces an optional scrubbing parameter so that the caller can explicitly clean the buffer, reducing the window in which key material might be read. Because the exploit does not require external network access, the threat is confined to hosts where the vulnerable kernel is deployed.