In the Linux kernel, the AF_ALG interface can trigger a NULL pointer dereference when chaining new scatter/gather lists. The problem occurs if a sendmsg() call fills an SGL to its maximum size and a subsequent sendmsg() allocates a new SGL without clearing the end marker on the previous list, causing the crypto scatterwalk to stop early and dereference a null pointer. This results in a kernel panic, abruptly halting system operation. The flaw is a classic NULL pointer dereference (CWE-476) and leads to a top‑tier denial‑of‑service impact.

All Linux kernel builds that preceded the inclusion of commit 00cbdec17c15d024a1c5002c7365df7624a18a75 and the accompanying patches are vulnerable. The affected code resides in the AF_ALG subsystem and the issue is not restricted to a specific distribution or kernel version identifier. Systems running a kernel without the fix commit are susceptible.

The vulnerability causes a kernel panic, a severe denial‑of‑service condition. The CVSS score of 5.5 indicates moderate severity. EPSS data are unavailable, so the exploitation probability is unquantified. It is likely exploitable only by a local user who can create and send crafted messages to an AF_ALG socket. Although the vulnerability is not listed in the CISA KEV catalog, the combination of a local privilege requirement and the severe impact makes it a significant risk for environments that use the AF_ALG interface.