The Linux kernel contains a bug in the s390 Dasd ECKD device checker. The calculation of the format‑check buffer size uses a 32‑bit integer to store a value that may exceed 2^32‑1, so truncation silently occurs. This causes kzalloc to allocate a buffer that is too small while the driver later writes to the full length of the track count. The result is a heap buffer overflow that can corrupt memory and, if exploited, can lead to arbitrary code execution within the kernel.

The flaw appears in the dasd module of the Linux kernel on systems that use the s390 architecture. Any kernel containing an unpatched dasd_eckd_check_device_format function is affected. The list of insecure kernel versions is not provided, but all builds before the described commit are vulnerable.

The CVSS score is not listed, and the EPSS score is unavailable, but the vulnerability qualifies as a critical heap buffer overflow that can lead to privilege escalation or denial of service. The KEV catalog does not list it yet. An attacker would need local access to a DASD device on the s390 platform and sufficient privileges to trigger the device check, which is typically available to administrators or users with proper device permissions. The lack of an external exploitation score means organizations should treat it as high risk until a patch is deployed.