The Linux kernel’s AF_ALG cryptographic interface contains a flaw in the af_alg_get_rsgl() function that extracts received data from scatterlists without respecting the socket’s receive‑buffer budget. This can result in more data being copied into the socket buffer than it can handle, causing repeated failures of recvmsg or silent truncation of requests and leading to denial of service. The weakness is a buffer allocation control flaw (CWE‑770) and is also classified under the NVD-CWE-noinfo category.

All Linux kernel builds that include the AF_ALG interface before the patch – regardless of distribution or minor kernel version – are affected. Systems running any kernel that processes af_alg scatterlist extraction without capping for the receive‑buffer budget remain vulnerable until the kernel is updated or the socket budget is manually adjusted.

The CVSS score of 5.5 classifies the vulnerability as medium severity, whereas the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local system access and sufficient privileges to interact with AF_ALG sockets, for example by running a malicious process on the same host or exploiting a local privilege escalation. Successful exploitation would manifest as service disruption from repeated recvmsg failures rather than privilege escalation or data exfiltration.