A flaw in the Linux kernel’s authencesn cryptographic routine writes high‑order sequence bits to the destination buffer during out‑of‑place decryption, even though those bits could simply be copied from the source. This incorrect write is an instance of both CWE-237 (Improper Calculation of Exception‑Based Errors) and CWE-682 (Incorrect Calculation of a Result). Because the data that is subsequently hashed is rearranged incorrectly, the resulting hash no longer matches the actual plaintext, potentially leading to authentication or integrity failures.

The vulnerability resides in the authencesn cryptographic routine of the Linux kernel. Any kernel version that does not yet include the patch that removes the unnecessary write to the destination buffer is potentially exposed. The affected version information is not explicitly listed, so all releases prior to the fix should be considered at risk.

The CVSS score is 7.8 and the EPSS score is less than 1%, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply crafted input to the kernel’s authencesn decryption function in order to influence the hashing operation; such input would likely require kernel‑level access or the ability to control kernel memory. No publicly available exploit has been reported, and the low EPSS suggests a low probability of real‑world exploitation, but the inherent error in cryptographic handling warrants cautious assessment.