A race condition exists in the Linux kernel helper function _destroy_pages_crste() used by KVM on s390 platforms. When multiple page destruction requests occur concurrently, the function can read a pointer, then later dereference it after the referenced object has been freed, potentially corrupting kernel memory. While the official fix removes this race by using READ_ONCE(), the unpatched code could lead to unpredictable kernel behavior. This outcome is inferred: benign memory corruption could be exploited by an attacker with sufficient local or privileged access to gain higher privileges or to crash the system.

Any Linux kernel targeting the s390 architecture that lacks the commit adding READ_ONCE() to _destroy_pages_crste() is potentially vulnerable. The advisory does not specify an exact version range, but older kernels that have not applied the described patch remain at risk.

The CVSS score of 5.6 indicates moderate severity, while the EPSS score of less than 1% reflects a very low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. Exploitation would require local or privileged access, precise timing, and knowledge of KVM page‑destruction behavior, making the risk lower but not negligible. The attack vector is inferred to be local or through a compromised VM, as the flaw resides in the kernel's VM management code.