The Linux kernel’s algif_aead socket interface performs a minimum receive buffer size check during decryption but originally omitted the authentication tag length from the calculation. This oversight allows an attacker to send a packet whose payload is smaller than the combined payload and tag size, causing the decryption path to read or write beyond the bounds of the allocated buffer. The resulting memory corruption can crash the kernel or, if exploited further, could potentially enable arbitrary code execution. The vulnerability is classified as CWE‑131, incorrect size calculations.

Any Linux kernel that has not incorporated the patch that adds the missing tag size to the minimum RX size check is potentially affected. The CVE does not specify a version range, so administrators should verify that their kernel includes the referenced commit (e.g., 1c76b5675, 3afdc15d6, 3d14bd48e) or that their distribution’s security update applies the fix.

The CVSS score of 5.5 indicates a moderate severity level, while the EPSS score of <1% suggests a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An adversary would need to target a system exposing the algif_aead socket interface, which is commonly enabled on many Linux distributions by default. The attack can be mounted remotely by sending a specially crafted packet, without requiring privileged access on the target machine. Based on the description, the flaw could lead to a kernel panic or loss of memory integrity.