The tegra crypto driver omitted setting the CRYPTO_ALG_ASYNC flag on its asynchronous algorithms, triggering a CWE-166 flaw and a CWE-617 flaw in the driver initialization. Because the flag is missing, the crypto API may incorrectly select these asynchronous algorithms when a request specifies only synchronous operation, leading to crashes during user or system-level crypto operations and effectively enabling a denial of service. The likely attack vector involves an entity that can trigger crypto operations that request synchronous algorithms while the tegra driver is loaded, inferred from the description.

All Linux distributions that ship an unpatched kernel containing the tegra crypto driver are affected. The vulnerability applies to any kernel version released before the patch commits that added the missing flag. Systems that enable the tegra crypto driver in their kernel configuration are the ones that should assess if the driver is active.

The CVSS score of 8.8 indicates high severity. No public exploits or reported incidents are documented. The EPSS score, reported as less than 1%, indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to trigger a synchronous crypto request that routes through the tegra driver. Based on the description, it is inferred that such operations can be triggered by user or system-level processes capable of invoking the kernel crypto API. The vulnerability can lead to a kernel crash and interrupt affected services.