The flaw causes the kernel function read_key_from_user_keying() to write the first eight bytes of a dm‑crypt key to the debug trace whenever kernel debug logging is enabled. This results in the partial exposure of an otherwise protected encryption key, creating an information‑disclosure vulnerability classified as CWE‑215. The vulnerability does not impact application functionality directly but compromises the confidentiality of encrypted data stored by dm‑crypt by leaking key material.

All Linux kernel builds containing the unpatched read_key_from_user_keying() function are affected, regardless of the distribution or vendor. The issue appears in the source code that was patched in the 7.0 releases. No specific version numbers are listed in the advisory, so any kernel version prior to the commit that removes the key logging is vulnerable.

The CVSS score of 5.5 indicates moderate severity. An EPSS score of less than 1% suggests that practical exploitation is unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have the ability to enable kernel debug logging and read the resulting trace logs, which typically requires elevated or kernel‑level privileges.