The vulnerability arises from the s390/vfio-ap subsystem using an uninitialized bitmap called apm_filtered. When a hot‑plug configuration change adds only control domains, the initialization function is bypassed, leaving apm_filtered empty on the stack. The reset_queues_for_apids() routine interprets random stack garbage as valid APIDs to reset, which can cause unintended resets of guest hardware queues. The resulting denial of service can affect the stability and availability of guest systems that rely on these queues.

The flaw affects Linux kernel builds that run on the s390 architecture and include the vFIO AP (Virtual Function I/O for Appliance Processor) driver. No specific kernel version range is provided in the available data, so any kernel containing the vFIO AP code that has not yet been patched is potentially impacted.

No CVSS score is reported, and EPSS data is not available; the vulnerability is not listed in the CISA KEV catalog. Consequently, the quantitative severity is unknown. The likely attack vector involves manipulation of hot‑plug configuration changes, which would require privileged access to the host system. Because the flaw leads directly to queue resets that can destabilize guest workloads, the risk to availability is significant for affected environments. The lack of publicly observed exploitation combined with the privileged nature of the required actions suggests moderate to high potential impact if a system is not promptly updated.