The vulnerability lies in the crypto IAAs module of the Linux kernel, where the function find_empty_iaa_compression_mode can return the constant IAA_COMP_MODES_MAX instead of a valid index when no empty mode is found. This out‑of‑bounds index is then used in add_iaa_compression_mode, causing an invalid array access that may corrupt kernel memory or trigger a kernel panic, effectively denying service to the affected system. The weakness is a classic out‑of‑bounds read, classified as CWE‑125.

All Linux kernel releases prior to the patch commit that introduces the fix are affected. The exact range of affected versions is not listed, but any kernel containing the unpatched iaa implementation and the find_empty_iaa_compression_mode routine may suffer from this flaw.

The CVSS score of 7.1 indicates a moderate-to-severe risk. The EPSS score of less than 1% suggests low exploitation probability in the wild at the time of analysis. The vulnerability is not listed in CISA KEV, implying no known active exploitation. Attacks would most likely require local or privileged access to trigger the faulty path and induce the kernel crash, as no remote vector is described. Thus, the threat is primarily a local denial‑of‑service scenario.