cryptodev-linux drivers version 1.14 and earlier contain a page reference handling flaw in the get_userbuf function. The error allows the driver to decrement reference counts of pages multiple times, resulting in a use‑after‑free condition. This flaw is mapped to CWE‑416 and can be exploited by a local user to gain elevated privileges on the system.

The vulnerability affects the cryptodev-linux package from the cryptodev-linux vendor. Any installation of cryptodev-linux version 1.14 or earlier is impacted. The driver exposes its functionality through the /dev/crypto interface, which is commonly used by local applications for cryptographic operations.

The CVSS score of 8.5 indicates a high severity condition. Although the EPSS score is not available, the lack of a CISA KEV listing does not diminish the potential for exploitation. Attackers only need local access to the /dev/crypto interface, a condition that is likely satisfied on most systems using the driver. Successful exploitation results in local privilege escalation, potentially allowing the attacker to execute arbitrary code with elevated permissions.