A buffer overflow occurs in the Linux kernel's caam crypto module when an HMAC key larger than the block size is supplied. The key is duplicated with kmemdup, which incorrectly reads additional bytes from the source buffer, allowing the resulting copy to overwrite adjacent memory. This memory corruption can compromise data integrity and potentially grant an attacker the ability to execute arbitrary code in kernel space, leading to full system compromise, or cause a denial of service by crashing the kernel.

All Linux kernel implementations that include the caam cryptographic accelerator and use HMAC keys longer than the acceptable block size are affected. No specific kernel versions are listed in the data, so the vulnerability may be present across multiple releases where caam is enabled.

The CVSS score is not provided, but the described overflow can lead to arbitrary code execution, which is considered a severe impact. Without an EPSS score or KEV listing, the current exploit probability is unknown; however, kernel memory corruption bugs historically are prized by attackers. The most likely attack vector is a local or privileged user who can supply an oversized HMAC key through an application that uses the caam module. Detection would require evidence of neighboring memory corruption or abnormal kernel behavior.