Technical impact
When the Linux kernel attempts to save or load a hibernate image, it may try to free a crypto compressor that was never successfully allocated if the chosen compression algorithm (e.g., LZO) is not available. The cleanup code unconditionally calls crypto_free_acomp() on an error pointer, which dereferences an invalid address and causes a kernel panic. This loss of stability results in a full system reboot and loss of all services until the machine restarts.
Affected Systems
All Linux kernels that include the hibernate subsystem and invoke crypto_alloc_acomp during suspend or resume, regardless of distribution. Any build lacking the selected compression algorithm—such as a kernel compiled without CONFIG_CRYPTO_LZO—satisfies the conditions for the flaw.
Risk and Exploitability
The entry has a CVSS score of 5.5 and an EPSS score of less than 1%, indicating moderate severity and low likelihood of known exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a local action that triggers a suspend or resume operation; this typically requires privileged user access or system configuration changes. Because the flaw requires kernel‑mode execution and local privilege, remote exploitation is not viable without additional compromises.
Ubuntu USN