The kernel’s AEAD helper previously performed an in‑place copy of authentication data when the source and destination buffers came from different memory mappings. This code path was removed in the revert commit, simplifying the logic to copy the data directly into a separate buffer. The revert fixes an issue in the in‑place copy routine that could result in incorrect handling of authentication data, potentially leading to cryptographic failures or crashes during cryptographic operations.

Any Linux kernel release that incorporated the earlier in‑place copy routine before the revert contains the impacted code. Distributions that ship kernel versions with this logic—such as Red Hat Enterprise Linux, Ubuntu, Debian, SUSE Enterprise, Amazon Linux, and other derivatives—are affected unless they have applied a subsequent update or the revert commit. Refer to each vendor’s errata for specific kernel versions that include the fix.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score of 98% indicates a very high likelihood that the vulnerability is being exploited in the wild. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active use by threat actors. Based on the description, it is inferred that an attacker could trigger the cryptographic helper through locally available or privileged code to exploit the in‑place copy logic, potentially leading to kernel memory corruption or denial of service.