Based on the description, it is inferred that the flaw occurs when a cryptographic callback in s390/crypto returns a negative error code after having explicitly completed a request. The crypto engine mistakenly interprets this as a failure to take ownership and issues a second completion call to crypto_request_complete, thereby double‑completing a request. This double completion can corrupt subsequent data processing or produce inconsistent results, potentially leading to a denial of service for services that rely on the kernel’s cryptographic subsystem.

The issue affects all Linux kernel builds that include the s390/crypto subsystem, specifically the modules paes_s390.c (four callbacks for ecb, cbc, ctr, xts) and phmac_s390.c (one callback). No specific version range is supplied, and the patch applies to all current builds that contain these modules.

Based on the description, it is inferred that the attack vector would require local or privileged execution that can trigger cryptographic requests targeting the affected kernel. The CVSS score of 7 indicates moderate severity. The EPSS score of <1% shows a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. No publicly documented exploit evidence is available, so the risk is considered moderate for systems running the s390 architecture that rely on the crypto engine.