The Linux kernel contains a flaw in the s390 crypto subsystem where temporary buffers used by the AES CTR and GCM engines are not cleared after use. The missing scrubbing can cause residual data from previous operations to remain in memory, which could be read by an entity with kernel access or a privileged process, allowing it to recover sensitive information such as cryptographic keys or partial plaintext. This weakness is an instance of improper handling of confidential data, classified by CWE‑459.

This issue affects all Linux kernel releases that run on the s390 architecture and still contain the s390/crypto code paths for AES CTR and GCM prior to the commits referenced in the advisory. No specific version numbers are provided, so any kernel without those moves is potentially vulnerable.

The likely attack vector is local to an attacker who can execute code with kernel or privileged privileges; remote exploitation is not possible. While the flaw does not enable arbitrary code execution, the EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, indicating limited reported exploitation. However, because the CVSS score is 5.5, the risk remains that an insider or compromised application could use the vulnerability for information disclosure, warranting a prompt patch.