The vulnerability resides in the Linux kernel’s s390/uv subsystem, where, when more than 85 secrets are present, the uv_secret_list array only contains up to 85 items per page. This mismatch causes an out‑of‑bounds read during the find_secret_in_page operation if the sought secret lies on a following page or is absent. The resulting memory read can expose kernel data, potentially leaking sensitive information. The weakness is an improper memory access, categorised as an out-of-bounds read.

Affected systems are Linux kernel implementations that include the s390/uv module. No specific vendor or version information is available in the provided data, so all Linux kernel distributions that compile this module are considered potentially impacted.

The exploit scenario requires the attacker to trigger find_secret_in_page with more than 85 secrets stored, which implies local or privileged access to the target. Although no public exploit is listed in KEV and EPSS data is unavailable, the act of reading privileged kernel memory is a serious risk. The severity is uncertain due to lack of a CVSS score, but the theoretical impact remains significant enough for administrators to treat the vulnerability with caution until an official patch is applied.