The flaw emerges when the KVM injector for the s390 architecture performs a SIGP Stop and Store Status operation while a virtual CPU is running. In that scenario the interrupt is marked as pending and the status is written directly into user space via the thread handling KVM_RUN. Because the function executes while holding a spinlock, a fault in the user‑space write can trigger a kernel panic or other host instability. The result is a denial‑of‑service condition that compromises host availability.

All installations of the Linux kernel that include the KVM hypervisor for the s390 architecture are affected. No specific kernel version range is listed; the vulnerability exists until a patch that returns ‑EWOULDBLOCK and defers the Store Status write is applied. The issue is present in any kernel where the bug remains unpatched, regardless of distribution or patch level.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is local, privileged access required to issue the vulnerable KVM_RUN ioctl and trigger the SIGP Stop and Store Status operation. No evidence of remote exploitation is reported.