The issue involved an in‑place copying routine in the Linux kernel’s AEAD cryptographic helper that improperly copied authentication data from a source buffer to a destination buffer that were mapped separately. The erroneous copy path could overwrite unrelated kernel memory, leading to corrupted state. The fix removes this unsafe logic and performs an out‑of‑place copy of the authentication data, preventing the memory corruption flaw.

All kernel builds that contained the in‑place copy helper before the revert are affected. This includes mainstream distributions such as Ubuntu, Debian, Red Hat Enterprise Linux, SUSE Enterprise, and Amazon Linux, among other Linux systems that shipped the vulnerable kernel code. Any machine running a vulnerable kernel version remains at risk until the patch is applied.

The CVSS score of 7.8 indicates high severity, and the EPSS score of 100 % signals an extremely high likelihood of exploitation. The vulnerability is listed in CISA’s KEV catalog, confirming active exploitation in the field. Exploitation would require triggering the cryptographic helper, typically via local or privilege‑escalating activity that performs AEAD operations. Successful exploitation could result in kernel memory corruption, potentially enabling privilege escalation or denial of service.