A flaw in the s390/zcrypt module of the Linux kernel incorrectly verifies the upper bound of the domain field in EP11 CPRB requests, allowing an administrative CPRB to access memory beyond the perms->adm structure. This can corrupt kernel memory, potentially enabling privilege escalation or causing a system crash, as the corruption occurs in kernel space. The flaw reflects an out‑of‑bounds write (CWE‑787).

The vulnerability affects Linux kernels that include the s390/zcrypt module; any kernel version prior to the commit that introduced the correct limit (AP_DOMAINS = 256) is vulnerable. No specific release identifiers are listed, so the assumption is that all kernels on the s390 architecture before the patch are impacted.

The CVSS score is 7.8, indicating high severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the ability to send a crafted EP11 CPRB to the zcrypt subsystem, inferred to be achievable through write access to a custom zcrypt device node or through control over a compromised crypto card. If exploited, kernel memory corruption could lead to privilege escalation or denial of service.