The Linux kernel contained an issue where a temporary buffer used during the Paes algorithm was not cleared after encryption. This oversight could allow residual data to remain in kernel memory, leading to accidental exposure of sensitive information. The flaw is a classic example of poorly handled sensitive data, closely aligning with information‑exposure weaknesses.

The vulnerability applies to all Linux kernel releases that compile the s390/crypto module before the fix was incorporated. The affected code is part of the kernel’s cryptographic subsystem and is not limited to a specific version range in the provided data; however, any kernel build that includes the unpatched logic is vulnerable. The fix is implemented via the commits linked in the reference list and will be present in newer kernel releases that incorporate those patches.

The CVSS score is 5.5, but the lack of a known exploit and the absence from CISA’s KEV catalog suggest a moderate theoretical risk for systems that allow untrusted code to operate in kernel context. The EPSS score is < 1%, indicating a very low probability of exploitation. Based on the description, it is inferred that attackers would need local privileged access—such as the ability to load kernel modules—to trigger the flaw. Once executed, the impact is limited to confidentiality leakage rather than remote code execution.