The vulnerability stems from confusion between virtual and physical addresses used by the s390 channel measurement framework in the Linux kernel. The measurement block address is treated as an absolute address, but the associated configuration fields were not properly typed, allowing incorrect assignments. A missing virt_to_dma64() translation meant that, on systems compiled with address randomization enabled, the firmware could store extended format channel measurement data at the wrong location. The consequence is corrupting measurement data and potentially disrupting firmware operations. This flaw does not directly provide arbitrary code execution; it primarily leads to data corruption and possible denial of service.

All Linux kernel deployments that enable CONFIG_RANDOMIZE_IDENTITY_BASE=y are affected, regardless of distribution. The issue exists across kernel versions that lack the patch that corrects the address confusion by defining the relevant fields as dma64_t and adding the necessary translation. Since specific version numbers are not provided, any kernel built with address randomization enabled remains at risk until updated.

The CVSS score is 5.1, and the EPSS score is < 1%, indicating that the overall exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog, suggesting that there is no known active exploitation. Nevertheless, the flaw could be leveraged by a privileged user or an attacker with firmware access to cause data corruption or a denial of service. The likely attack vector involves tampering with firmware operations that rely on the measurement block address, typically requiring kernel-level privileges or trusted firmware control.