The vulnerability resides in the Linux kernel’s OMAP cryptographic driver, where an incorrect allocation size for scatterlists can lead to memory corruption. The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation. Use of an incorrect allocation size results in out‑of‑bounds writes when the driver populates the scatterlist array, potentially overwriting arbitrary kernel memory and enabling arbitrary code execution within kernel mode.

Linux kernel encryption drivers employing the OMAP_CRYPTO_FORCE_COPY feature are affected. All kernel versions that include the buggy omap_crypto_copy_sg_lists() implementation are vulnerable; the patch is present in kernel releases newer than the commit referenced in the advisory. Specific vendor or product versions are not enumerated beyond the Linux kernel as a whole.

The CVSS score of 7.8 denotes a high severity. EPSS less than 1% indicates that the likelihood of exploitation is very low at the time of this analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a local privilege escalation or an attacker with sufficient access to the OMAP crypto device, since the flaw is triggered during driver operations. Exploitation would require influence over driver input to trigger the out‑of‑bounds write and is thus not trivially exploitable by remote actors.