The vulnerability originates from a missing spinlock around the virtqueue used by virtio-crypto. When a virtual machine boots with a virtio-crypto PCI device and the builtin backend is active, running multiple OpenSSL benchmark processes causes the kernel to hang and emit an error indicating a corrupted virtqueue pointer. The lack of synchronization results in a race condition that can lead to abrupt process termination and inconsistent state inside the virtio-crypto subsystem, thereby denying service to legitimate workloads. The weakness is a classic race condition, where concurrent access to shared data without adequate locking yields corruption. This disorder can manifest during high concurrency scenarios, particularly when external applications overuse the crypto engine, and can be triggered via normal user activity such as cryptographic workloads.

All Linux distributions that ship a kernel with the virtio-crypto driver and a builtin backend. The kernel CPE string indicates that the issue applies to the kernel release itself, not a specific vendor build, so any distribution kernel that has not been updated to include the spinlock protection is affected. The vendor list lists Linux:Linux twice, signifying a general kernel vulnerability. The affected versions are not enumerated in the source, so any release prior to the patch remains vulnerable.

The severity of the issue is scored as a CVSS of 5.5, placing it in the moderate range. Exploitation likelihood is estimated to be low, with an EPSS score below 1%, and the vulnerability is not listed in the CISA KEV catalog. Attacks would require a user to run multiple concurrent OpenSSL or similar processes targeting the virtio-crypto device, a scenario that may occur by default on modern workloads. Because the flaw does not expose remote code execution or privilege escalation, the immediate threat is limited to service interruption. Nonetheless, the presence of a race condition in a core kernel module warrants prompt attention, particularly for systems exposed to high concurrency cryptographic operations.