The vulnerability exists in the Linux kernel's authencesn cryptographic module, which processes ESP/ESN-formatted authenticated encryption data. When the associated data (AAD) is shorter than eight bytes, the function crypto_authenc_esn_decrypt can advance past the end of the destination scatterlist, causing a NULL pointer dereference inside scatterwalk_map_and_copy and resulting in a kernel crash that denies service. This represents a classic null pointer dereference (CWE‑476) that can be leveraged to compromise availability.

Linux kernel deployments are affected, specifically kernel versions 6.19 and its release candidates 6.19‑rc1 through 6.19‑rc6, as well as any derivative builds identified by the corresponding CPE entries. All distributions shipping these kernel versions are therefore impacted.

The CVSS score is 5.5, indicating moderate severity. An EPSS score below 1 % and absence from KISA’s KEV catalog suggest low likelihood of active exploitation. An attacker would need to inject malformed ESP/ESN packets with too‑short AAD toward a vulnerable host; if processed, the kernel will panic, causing a localized denial of service. This risk is limited to the affected system’s availability and requires no additional privileges beyond the capability to send crafted packets.