An out‑of‑bounds read occurs in the Linux kernel when generating an SCLP report on s390 platforms. The function report_error_write() verifies that the supplied buffer is large enough to hold a header, but it does not ensure the buffer can accommodate the payload specified by report->length. If a user supplies a short buffer, data from a larger kmalloc allocation can be read and included in the report, leaking up to around four kilobytes of kernel memory. This does not expose data that the privileged entity cannot already access, but it still represents an information disclosure and an improper handling of error reports. The flaw is a classic out‑of‑bounds read that is triggered by a malformed input.

All Linux kernel implementations running on IBM S/390 (s390) architecture that contain the s390/pci subsystem before the patch. The affected code is present in the Linux kernel source tree and is noted by the vendor as part of the Linux kernel distribution.

The vulnerability can be triggered only by a privileged entity that can generate an SCLP report, such as an operating system component or kernel module with the required permissions. Because the leak is limited to data already accessible by that entity, the risk is confined to privileged-level information disclosure rather than system compromise. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation at this time. Nonetheless, it represents an out‑of‑bounds read that should be mitigated before the privileged component accepts user‑controlled report size values.