The vulnerability arises in the s390 DASD driver’s ECKD format-check function, where a 64‑bit buffer size calculation is silently truncated into a 32‑bit variable. This causes kzalloc to allocate an undersized buffer while later code writes past the end of that buffer, corrupting kernel heap memory. The resulting local heap overflow can be leveraged by an attacker with access to the affected DASD device to gain escalated privileges within the kernel.

All Linux kernel builds targeting the s390 architecture that include the unpatched dasd_eckd_check_device_format function are vulnerable. This spans every distribution kernel prior to the patch that changes the fmt_buffer_size variable to a size_t and introduces a check_mul_overflow() guard. Once the patch is applied, the vulnerability is eliminated.

The CVSS score of 7.8 reflects a high severity local exploit. The EPSS score is less than 1 %, indicating a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires local access to a DASD device and the ability to invoke the device check, typically through administrative or privileged user rights. Based on the description, the likely attack vector is local exploitation via a legitimate DASD operation, which could lead to kernel privilege escalation if successful.