The Linux kernel’s s390 PCI subsystem contains a race condition because the function zpci_report_status() can access a device’s driver without holding the required device lock when the device pointer (pdev) is non‑NULL. This missing lock can allow concurrent operations to observe or modify the device state in an inconsistent manner, potentially leading to data corruption or kernel instability. The flaw does not provide remote code execution or clear denial of service, but it can degrade system reliability for privileged users that interact with s390 PCI devices.

The vulnerability exists in the s390/pci component of the Linux kernel. No specific kernel version numbers are listed, so all s390‑compatible kernels that compile the current implementation of zpci_report_status() may be affected until the patch is applied. Users of older kernels that are still maintained by their distribution may be able to upgrade to a version containing the fix.

The CVSS score of 4.1 indicates a low severity weakness. The EPSS score is less than 1 % and the CVE is not listed in the CISA KEV catalog, suggesting that exploitation activity is minimal. Based on the description, it is inferred that the attack vector is local and requires kernel‑level or privileged access to trigger the race condition. The overall risk is low; however, a persistent or privileged attacker could induce instability or corruption if the bug is repeatedly triggered.