The kernel performs an X.509 extension parse that reads the first byte of a certificate extension before verifying its length, which causes an out‑of‑bounds read when a certificate contains an empty Basic Constraints or Key Usage extension. An attacker can exploit this by submitting a crafted certificate to the keyrings(7) API, enabling an unprivileged local user to read beyond the intended buffer boundary. The resulting memory read may reveal sensitive kernel data, leading to information disclosure. The vulnerability is not confirmed to allow privilege escalation, but the exposed kernel memory could be leveraged as a pivot for further attacks.

Linux kernel distributions that have not yet incorporated the patch that fixes the out‑of‑bounds read when parsing X.509 extensions. The exact affected kernel versions are not listed; the fix applies to any kernel that contains the vulnerable code path identified in the CPE entry for Linux kernel.

The flaw is local, requiring the attacker to have a user account and access to the keyrings API. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the vulnerability permits reading kernel memory, it poses a high risk of information disclosure for systems where the kernel is compromised. The likely attack vector is an unprivileged local user submitting a malicious certificate via the keyring interface.