An out‑of‑bounds read can occur in the Linux kernel’s s390/uv subsystem when more than 85 secrets are present. The uv_secret_list array holds only 85 items per page, but the find_secret_in_page routine incorrectly iterates over the total number of secrets rather than the per‑page count, causing a memory read beyond the bounds of the array. This flaw permits a privileged attacker to read kernel memory that may contain sensitive information, exposing an improper memory access weakness.

All Linux kernel implementations that include the s390/uv module are potentially affected. The vulnerability exists in the kernel’s core, and the affected products are generic Linux kernels compiled with the unsanitized uv module; no specific version numbers are listed in the CVE record, so it applies to any kernel build that contains the unpatched code.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The description does not state the privilege level required to trigger the vulnerability, but given that it involves a kernel memory read, it is inferred that local privileged or root access is needed. This inference is based on the nature of kernel‑level memory access. The vulnerability is not listed in the CISA KEV catalog, further supporting the assessment that active exploitation is low, but the potential for information disclosure remains a concern.