The vulnerability arises from the absence of a necessary synchronization mechanism in the KVM s390 IRQ status setting function. This omission allows concurrent race conditions that can corrupt interrupt state, potentially causing erratic behavior, VM instability, or crashes. The weakness corresponds to improper synchronization and is a CWE‑362 type flaw.

The flaw affects the Linux kernel’s KVM module on the s390 architecture. Any kernel version prior to the fix commit 7a33007b95c8908ae3980eb2b4c508f8936766df is vulnerable, and the issue is present in all Linux distributions shipping the affected kernel.

No CVSS score is available and the EPSS score is not provided, indicating a lack of public exploitation data; the vulnerability is not listed in KEV. Exploitation requires privileged access to the host hypervisor and is most likely local. With the available data, the risk is moderate, though successful exploitation could lead to denial of service for a virtual machine.